diff --git a/bin/delv/delv.c b/bin/delv/delv.c
index ae7aad957c..0cb8142f5a 100644
--- a/bin/delv/delv.c
+++ b/bin/delv/delv.c
@@ -369,7 +369,7 @@ print_status(dns_rdataset_t *rdataset) {
 
 	buf[0] = '\0';
 
-	if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+	if (rdataset->attributes.negative) {
 		strlcat(buf, "negative response", sizeof(buf));
 		strlcat(buf, yaml ? "_" : ", ", sizeof(buf));
 	}
@@ -474,9 +474,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
 			DNS_RDATASET_FOREACH (rdataset) {
 				dns_rdata_t rdata = DNS_RDATA_INIT;
 
-				if ((rdataset->attributes &
-				     DNS_RDATASETATTR_NEGATIVE) != 0)
-				{
+				if (rdataset->attributes.negative) {
 					continue;
 				}
 
@@ -497,9 +495,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
 			}
 		} else {
 			dns_indent_t indent = { "  ", 2 };
-			if (!yaml && (rdataset->attributes &
-				      DNS_RDATASETATTR_NEGATIVE) != 0)
-			{
+			if (!yaml && rdataset->attributes.negative) {
 				isc_buffer_putstr(&target, "; ");
 			}
 			result = dns_master_rdatasettotext(
diff --git a/bin/named/server.c b/bin/named/server.c
index ec9a1aea35..62a904230b 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -1325,7 +1325,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	dns_rdatatype_t rdtype;
 	const cfg_obj_t *obj;
 	dns_fixedname_t fixed;
-	unsigned int mode = 0;
+	dns_orderopt_t mode = dns_order_none;
 	const char *str;
 	isc_buffer_t b;
 	isc_result_t result;
@@ -1363,11 +1363,11 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	INSIST(cfg_obj_isstring(obj));
 	str = cfg_obj_asstring(obj);
 	if (!strcasecmp(str, "random")) {
-		mode = DNS_RDATASETATTR_RANDOMIZE;
+		mode = dns_order_randomize;
 	} else if (!strcasecmp(str, "cyclic")) {
-		mode = DNS_RDATASETATTR_CYCLIC;
+		mode = dns_order_cyclic;
 	} else if (!strcasecmp(str, "none")) {
-		mode = DNS_RDATASETATTR_NONE;
+		mode = dns_order_none;
 	} else {
 		UNREACHABLE();
 	}
diff --git a/bin/plugins/filter-a.c b/bin/plugins/filter-a.c
index 4811190783..745bfe4b9c 100644
--- a/bin/plugins/filter-a.c
+++ b/bin/plugins/filter-a.c
@@ -518,10 +518,10 @@ client_state_destroy(const query_ctx_t *qctx, filter_instance_t *inst) {
 static void
 mark_as_rendered(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
 	if (rdataset != NULL && dns_rdataset_isassociated(rdataset)) {
-		rdataset->attributes |= DNS_RDATASETATTR_RENDERED;
+		rdataset->attributes.rendered = true;
 	}
 	if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset)) {
-		sigrdataset->attributes |= DNS_RDATASETATTR_RENDERED;
+		sigrdataset->attributes.rendered = true;
 	}
 }
 
diff --git a/bin/plugins/filter-aaaa.c b/bin/plugins/filter-aaaa.c
index 043236850e..938b7389ae 100644
--- a/bin/plugins/filter-aaaa.c
+++ b/bin/plugins/filter-aaaa.c
@@ -522,10 +522,10 @@ client_state_destroy(const query_ctx_t *qctx, filter_instance_t *inst) {
 static void
 mark_as_rendered(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
 	if (rdataset != NULL && dns_rdataset_isassociated(rdataset)) {
-		rdataset->attributes |= DNS_RDATASETATTR_RENDERED;
+		rdataset->attributes.rendered = true;
 	}
 	if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset)) {
-		sigrdataset->attributes |= DNS_RDATASETATTR_RENDERED;
+		sigrdataset->attributes.rendered = true;
 	}
 }
 
diff --git a/lib/dns/include/dns/ncache.h b/lib/dns/include/dns/ncache.h
index 4c196aa7fa..979de11621 100644
--- a/lib/dns/include/dns/ncache.h
+++ b/lib/dns/include/dns/ncache.h
@@ -73,7 +73,7 @@ dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
  * The 'covers' argument is the RR type whose nonexistence we are caching,
  * or dns_rdatatype_any when caching a NXDOMAIN response.
  *
- * 'optout' indicates a DNS_RDATASETATTR_OPTOUT should be set.
+ * 'optout' parameter indicates if 'optout' attribute should be set.
  *
  * Note:
  *\li	If 'addedrdataset' is not NULL, then it will be attached to the added
diff --git a/lib/dns/include/dns/order.h b/lib/dns/include/dns/order.h
index f628ad5778..0ed7951edd 100644
--- a/lib/dns/include/dns/order.h
+++ b/lib/dns/include/dns/order.h
@@ -32,18 +32,16 @@ dns_order_create(isc_mem_t *mctx, dns_order_t **orderp);
 void
 dns_order_add(dns_order_t *order, const dns_name_t *name,
 	      dns_rdatatype_t rdtype, dns_rdataclass_t rdclass,
-	      unsigned int mode);
+	      dns_orderopt_t mode);
 /*%<
  * Add a entry to the end of the order list.
  *
  * Requires:
  * \li	'order' to be valid.
  *\li	'name' to be valid.
- *\li	'mode' to be one of #DNS_RDATASETATTR_RANDOMIZE,
- *		#DNS_RDATASETATTR_FIXEDORDER or zero (#DNS_RDATASETATTR_CYCLIC).
  */
 
-unsigned int
+dns_orderopt_t
 dns_order_find(dns_order_t *order, const dns_name_t *name,
 	       dns_rdatatype_t rdtype, dns_rdataclass_t rdclass);
 /*%<
diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
index c3c96ce72e..74b1499d9b 100644
--- a/lib/dns/include/dns/rdataset.h
+++ b/lib/dns/include/dns/rdataset.h
@@ -128,10 +128,40 @@ struct dns_rdataset {
 	dns_trust_t	trust;
 	dns_rdatatype_t covers;
 
-	/*
-	 * attributes
-	 */
-	unsigned int attributes;
+	struct {
+		bool question	 : 1;
+		bool rendered	 : 1;  /*%< message.c: was rendered */
+		bool answered	 : 1;  /*%< server. */
+		bool cache	 : 1;  /*%< resolver. */
+		bool answer	 : 1;  /*%< resolver. */
+		bool answersig	 : 1;  /*%< resolver. */
+		bool external	 : 1;  /*%< resolver. */
+		bool ncache	 : 1;  /*%< resolver. */
+		bool chaining	 : 1;  /*%< resolver. */
+		bool ttladjusted : 1;  /*%< message.c: data had differing TTL
+			values, and the rdataset->ttl holds the smallest */
+		bool chase	  : 1; /*%< Used by resolver. */
+		bool nxdomain	  : 1;
+		bool noqname	  : 1;
+		bool checknames	  : 1; /*%< Used by resolver. */
+		bool required	  : 1;
+		bool resign	  : 1;
+		bool closest	  : 1;
+		bool optout	  : 1; /*%< OPTOUT proof */
+		bool negative	  : 1;
+		bool prefetch	  : 1;
+		bool stale	  : 1;
+		bool ancient	  : 1;
+		bool stale_window : 1;
+		bool stale_added  : 1; /*%< Added during a
+			stale-answer-client-timeout lookup. In other words, the
+			RRset was added during a lookup of stale data and does
+			not necessarily mean that the rdataset itself is stale.
+		      */
+		bool	       keepcase	  : 1;
+		bool	       staticstub : 1;
+		dns_orderopt_t order	  : 2;
+	} attributes;
 
 	/*%
 	 * the counter provides the starting point in the "cyclic" order.
@@ -143,7 +173,7 @@ struct dns_rdataset {
 
 	/*
 	 * This RRSIG RRset should be re-generated around this time.
-	 * Only valid if DNS_RDATASETATTR_RESIGN is set in attributes.
+	 * Only valid if 'resign' attribute is set.
 	 */
 	union {
 		isc_stdtime_t resign;
@@ -237,56 +267,6 @@ struct dns_rdataset {
 	DNS_RDATASET_FOREACH_RES(rds, DNS__RDATASET_CONCAT(x, __LINE__))
 /* clang-format on */
 
-/*!
- * \def DNS_RDATASETATTR_RENDERED
- *	Used by message.c to indicate that the rdataset was rendered.
- *
- * \def DNS_RDATASETATTR_TTLADJUSTED
- *	Used by message.c to indicate that the rdataset's rdata had differing
- *	TTL values, and the rdataset->ttl holds the smallest.
- *
- * \def DNS_RDATASETATTR_LOADORDER
- *	Output the RRset in load order.
- *
- * \def DNS_RDATASETATTR_STALE_ADDED
- *	Set on rdatasets that were added during a stale-answer-client-timeout
- *	lookup. In other words, the RRset was added during a lookup of stale
- *	data and does not necessarily mean that the rdataset itself is stale.
- */
-
-#define DNS_RDATASETATTR_NONE	      0x00000000 /*%< No ordering. */
-#define DNS_RDATASETATTR_QUESTION     0x00000001
-#define DNS_RDATASETATTR_RENDERED     0x00000002 /*%< Used by message.c */
-#define DNS_RDATASETATTR_ANSWERED     0x00000004 /*%< Used by server. */
-#define DNS_RDATASETATTR_CACHE	      0x00000008 /*%< Used by resolver. */
-#define DNS_RDATASETATTR_ANSWER	      0x00000010 /*%< Used by resolver. */
-#define DNS_RDATASETATTR_ANSWERSIG    0x00000020 /*%< Used by resolver. */
-#define DNS_RDATASETATTR_EXTERNAL     0x00000040 /*%< Used by resolver. */
-#define DNS_RDATASETATTR_NCACHE	      0x00000080 /*%< Used by resolver. */
-#define DNS_RDATASETATTR_CHAINING     0x00000100 /*%< Used by resolver. */
-#define DNS_RDATASETATTR_TTLADJUSTED  0x00000200 /*%< Used by message.c */
-#define DNS_RDATASETATTR_FIXEDORDER   0x00000400 /*%< Fixed ordering. */
-#define DNS_RDATASETATTR_RANDOMIZE    0x00000800 /*%< Random ordering. */
-#define DNS_RDATASETATTR_CHASE	      0x00001000 /*%< Used by resolver. */
-#define DNS_RDATASETATTR_NXDOMAIN     0x00002000
-#define DNS_RDATASETATTR_NOQNAME      0x00004000
-#define DNS_RDATASETATTR_CHECKNAMES   0x00008000 /*%< Used by resolver. */
-#define DNS_RDATASETATTR_REQUIRED     0x00010000
-#define DNS_RDATASETATTR_REQUIREDGLUE DNS_RDATASETATTR_REQUIRED
-#define DNS_RDATASETATTR_UNUSED1      0x00020000
-#define DNS_RDATASETATTR_RESIGN	      0x00040000
-#define DNS_RDATASETATTR_CLOSEST      0x00080000
-#define DNS_RDATASETATTR_OPTOUT	      0x00100000 /*%< OPTOUT proof */
-#define DNS_RDATASETATTR_NEGATIVE     0x00200000
-#define DNS_RDATASETATTR_PREFETCH     0x00400000
-#define DNS_RDATASETATTR_CYCLIC	      0x00800000 /*%< Cyclic ordering. */
-#define DNS_RDATASETATTR_STALE	      0x01000000
-#define DNS_RDATASETATTR_ANCIENT      0x02000000
-#define DNS_RDATASETATTR_STALE_WINDOW 0x04000000
-#define DNS_RDATASETATTR_STALE_ADDED  0x08000000
-#define DNS_RDATASETATTR_KEEPCASE     0x10000000
-#define DNS_RDATASETATTR_STATICSTUB   0x20000000
-
 /*%
  * _OMITDNSSEC:
  * 	Omit DNSSEC records when rendering ncache records.
@@ -574,7 +554,7 @@ dns__rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
  * Return the noqname proof for this record.
  *
  * Requires:
- *\li	'rdataset' to be valid and #DNS_RDATASETATTR_NOQNAME to be set.
+ *\li	'rdataset' to be valid and 'noqname' attribute to be set.
  *\li	'name' to be valid.
  *\li	'neg' and 'negsig' to be valid and not associated.
  */
@@ -583,12 +563,12 @@ isc_result_t
 dns_rdataset_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name);
 /*%<
  * Associate a noqname proof with this record.
- * Sets #DNS_RDATASETATTR_NOQNAME if successful.
+ * Sets 'noqname' attribute if successful.
  * Adjusts the 'rdataset->ttl' to minimum of the 'rdataset->ttl' and
  * the 'nsec'/'nsec3' and 'rrsig(nsec)'/'rrsig(nsec3)' ttl.
  *
  * Requires:
- *\li	'rdataset' to be valid and #DNS_RDATASETATTR_NOQNAME to be set.
+ *\li	'rdataset' to be valid and 'noqname' attribute to be set.
  *\li	'name' to be valid and have NSEC or NSEC3 and associated RRSIG
  *	 rdatasets.
  */
@@ -603,7 +583,7 @@ dns__rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
  * Return the closest encloser for this record.
  *
  * Requires:
- *\li	'rdataset' to be valid and #DNS_RDATASETATTR_CLOSEST to be set.
+ *\li	'rdataset' to be valid and 'closest' attribute to be set.
  *\li	'name' to be valid.
  *\li	'nsec' and 'nsecsig' to be valid and not associated.
  */
@@ -612,12 +592,12 @@ isc_result_t
 dns_rdataset_addclosest(dns_rdataset_t *rdataset, dns_name_t *name);
 /*%<
  * Associate a closest encloset proof with this record.
- * Sets #DNS_RDATASETATTR_CLOSEST if successful.
+ * Sets 'closest' attribute if successful.
  * Adjusts the 'rdataset->ttl' to minimum of the 'rdataset->ttl' and
  * the 'nsec' and 'rrsig(nsec)' ttl.
  *
  * Requires:
- *\li	'rdataset' to be valid and #DNS_RDATASETATTR_CLOSEST to be set.
+ *\li	'rdataset' to be valid and 'closest' attribute to be set.
  *\li	'name' to be valid and have NSEC3 and RRSIG(NSEC3) rdatasets.
  */
 
diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
index 03b5b7cb4d..7985496351 100644
--- a/lib/dns/include/dns/types.h
+++ b/lib/dns/include/dns/types.h
@@ -236,6 +236,12 @@ typedef enum {
 	dns_masterformat_raw = 2,
 } dns_masterformat_t;
 
+typedef enum {
+	dns_order_none,
+	dns_order_cyclic,
+	dns_order_randomize
+} dns_orderopt_t;
+
 typedef enum {
 	dns_expire_lru = 0,
 	dns_expire_ttl = 1,
diff --git a/lib/dns/master.c b/lib/dns/master.c
index 12dea0f239..e9fae4e2ad 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -2898,7 +2898,7 @@ commit(dns_rdatacallbacks_t *callbacks, dns_loadctx_t *lctx,
 		if (dataset.type == dns_rdatatype_rrsig &&
 		    (lctx->options & DNS_MASTER_RESIGN) != 0)
 		{
-			dataset.attributes |= DNS_RDATASETATTR_RESIGN;
+			dataset.attributes.resign = true;
 			dataset.resign = resign_fromlist(this, lctx);
 		}
 		result = callbacks->add(callbacks->add_private, owner,
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index 0f0d680976..7112790f2c 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -83,9 +83,9 @@ struct dns_master_style {
 #define DNS_TOTEXT_LINEBREAK_MAXLEN 100
 
 /*% Does the rdataset 'r' contain a stale answer? */
-#define STALE(r) (((r)->attributes & DNS_RDATASETATTR_STALE) != 0)
+#define STALE(r) (((r)->attributes.stale))
 /*% Does the rdataset 'r' contain an expired answer? */
-#define ANCIENT(r) (((r)->attributes & DNS_RDATASETATTR_ANCIENT) != 0)
+#define ANCIENT(r) (((r)->attributes.ancient))
 
 /*%
  * Context structure for a masterfile dump in progress.
@@ -271,7 +271,7 @@ struct dns_dumpctx {
 				 FILE *f);
 };
 
-#define NXDOMAIN(x) (((x)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
+#define NXDOMAIN(x) (((x)->attributes.nxdomain))
 
 static const dns_indent_t default_indent = { "\t", 1 };
 static const dns_indent_t default_yamlindent = { "  ", 1 };
@@ -717,7 +717,7 @@ rdataset_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 		 * Type.
 		 */
 
-		if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+		if (rdataset->attributes.negative) {
 			type = rdataset->covers;
 		} else {
 			type = rdataset->type;
@@ -725,7 +725,7 @@ rdataset_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 
 		INDENT_TO(type_column);
 		type_start = target->used;
-		if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+		if (rdataset->attributes.negative) {
 			RETERR(str_totext("\\-", target));
 		}
 		switch (type) {
@@ -760,7 +760,7 @@ rdataset_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 		 * Rdata.
 		 */
 		INDENT_TO(rdata_column);
-		if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+		if (rdataset->attributes.negative) {
 			if (NXDOMAIN(rdataset)) {
 				RETERR(str_totext(";-$NXDOMAIN", target));
 			} else {
@@ -1143,7 +1143,7 @@ again:
 			}
 			fprintf(f, "; %s\n", dns_trust_totext(rds->trust));
 		}
-		if (((rds->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) &&
+		if ((rds->attributes.negative) &&
 		    (ctx->style.flags & DNS_STYLEFLAG_NCACHE) == 0)
 		{
 			/* Omit negative cache entries */
@@ -1169,7 +1169,7 @@ again:
 			}
 		}
 		if (((ctx->style.flags & DNS_STYLEFLAG_RESIGN) != 0) &&
-		    ((rds->attributes & DNS_RDATASETATTR_RESIGN) != 0))
+		    (rds->attributes.resign))
 		{
 			isc_buffer_t b;
 			char buf[sizeof("YYYYMMDDHHMMSS")];
@@ -1323,7 +1323,7 @@ dump_rdatasets_raw(isc_mem_t *mctx, const dns_name_t *owner_name,
 
 		dns_rdataset_getownercase(&rdataset, name);
 
-		if (((rdataset.attributes & DNS_RDATASETATTR_NEGATIVE) != 0) &&
+		if (rdataset.attributes.negative &&
 		    (ctx->style.flags & DNS_STYLEFLAG_NCACHE) == 0)
 		{
 			/* Omit negative cache entries */
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 1141562a58..50b0a80018 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -114,7 +114,7 @@ hexdump(const char *msg, const char *msg2, void *base, size_t len) {
 #define VALID_PSEUDOSECTION(s) \
 	(((s) >= DNS_PSEUDOSECTION_ANY) && ((s) < DNS_PSEUDOSECTION_MAX))
 
-#define OPTOUT(x) (((x)->attributes & DNS_RDATASETATTR_OPTOUT) != 0)
+#define OPTOUT(x) (((x)->attributes.optout))
 
 /*%
  * This is the size of each individual scratchpad buffer, and the numbers
@@ -998,7 +998,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 		dns_message_gettemprdataset(msg, &rdataset);
 		dns_rdatalist_tordataset(rdatalist, rdataset);
 
-		rdataset->attributes |= DNS_RDATASETATTR_QUESTION;
+		rdataset->attributes.question = true;
 
 		ISC_LIST_APPEND(name->list, rdataset, link);
 
@@ -1452,7 +1452,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 		 * minimize them.
 		 */
 		if (ttl != rdataset->ttl) {
-			rdataset->attributes |= DNS_RDATASETATTR_TTLADJUSTED;
+			rdataset->attributes.ttladjusted = true;
 			if (ttl < rdataset->ttl) {
 				rdataset->ttl = ttl;
 			}
@@ -1927,10 +1927,8 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 	name = ISC_LIST_HEAD(*section);
 	if (name != NULL) {
 		rdataset = ISC_LIST_HEAD(name->list);
-		if (rdataset != NULL &&
-		    (rdataset->attributes & DNS_RDATASETATTR_REQUIREDGLUE) !=
-			    0 &&
-		    (rdataset->attributes & DNS_RDATASETATTR_RENDERED) == 0)
+		if (rdataset != NULL && rdataset->attributes.required &&
+		    !rdataset->attributes.rendered)
 		{
 			st = *(msg->buffer);
 			count = 0;
@@ -1963,7 +1961,7 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 
 			update_min_section_ttl(msg, sectionid, rdataset);
 
-			rdataset->attributes |= DNS_RDATASETATTR_RENDERED;
+			rdataset->attributes.rendered = true;
 		}
 	}
 
@@ -1977,9 +1975,7 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 
 		ISC_LIST_FOREACH (*section, n, link) {
 			ISC_LIST_FOREACH (n->list, rds, link) {
-				if ((rds->attributes &
-				     DNS_RDATASETATTR_RENDERED) != 0)
-				{
+				if (rds->attributes.rendered) {
 					continue;
 				}
 
@@ -2051,7 +2047,7 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 
 				update_min_section_ttl(msg, sectionid, rds);
 
-				rds->attributes |= DNS_RDATASETATTR_RENDERED;
+				rds->attributes.rendered = true;
 			}
 		}
 	} while (--pass != 0);
@@ -2282,7 +2278,7 @@ dns_message_renderreset(dns_message_t *msg) {
 		msg->counts[i] = 0;
 		MSG_SECTION_FOREACH (msg, i, name) {
 			ISC_LIST_FOREACH (name->list, rds, link) {
-				rds->attributes &= ~DNS_RDATASETATTR_RENDERED;
+				rds->attributes.rendered = false;
 			}
 		}
 	}
@@ -5027,8 +5023,7 @@ message_authority_soa_min(dns_message_t *msg, dns_ttl_t *ttlp) {
 
 	MSG_SECTION_FOREACH (msg, DNS_SECTION_AUTHORITY, name) {
 		ISC_LIST_FOREACH (name->list, rds, link) {
-			if ((rds->attributes & DNS_RDATASETATTR_RENDERED) == 0)
-			{
+			if (!rds->attributes.rendered) {
 				continue;
 			}
 
diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c
index f0a82505bc..0fa3e7dac3 100644
--- a/lib/dns/ncache.c
+++ b/lib/dns/ncache.c
@@ -164,9 +164,7 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 
 		if (name->attributes.ncache) {
 			ISC_LIST_FOREACH (name->list, rdataset, link) {
-				if ((rdataset->attributes &
-				     DNS_RDATASETATTR_NCACHE) == 0)
-				{
+				if (!rdataset->attributes.ncache) {
 					continue;
 				}
 				type = rdataset->type;
@@ -261,12 +259,12 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 		trust = dns_trust_answer;
 	}
 	ncrdataset.trust = trust;
-	ncrdataset.attributes |= DNS_RDATASETATTR_NEGATIVE;
+	ncrdataset.attributes.negative = true;
 	if (message->rcode == dns_rcode_nxdomain) {
-		ncrdataset.attributes |= DNS_RDATASETATTR_NXDOMAIN;
+		ncrdataset.attributes.nxdomain = true;
 	}
 	if (optout) {
-		ncrdataset.attributes |= DNS_RDATASETATTR_OPTOUT;
+		ncrdataset.attributes.optout = true;
 	}
 
 	return dns_db_addrdataset(cache, node, NULL, now, &ncrdataset, 0,
@@ -292,7 +290,7 @@ dns_ncache_towire(dns_rdataset_t *rdataset, dns_compress_t *cctx,
 
 	REQUIRE(rdataset != NULL);
 	REQUIRE(rdataset->type == 0);
-	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0);
+	REQUIRE(rdataset->attributes.negative);
 
 	savedbuffer = *target;
 	count = 0;
@@ -508,7 +506,7 @@ dns_ncache_getrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 	REQUIRE(ncacherdataset != NULL);
 	REQUIRE(DNS_RDATASET_VALID(ncacherdataset));
 	REQUIRE(ncacherdataset->type == 0);
-	REQUIRE((ncacherdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0);
+	REQUIRE(ncacherdataset->attributes.negative);
 	REQUIRE(name != NULL);
 	REQUIRE(!dns_rdataset_isassociated(rdataset));
 	REQUIRE(type != dns_rdatatype_rrsig);
@@ -574,7 +572,7 @@ dns_ncache_getsigrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 
 	REQUIRE(ncacherdataset != NULL);
 	REQUIRE(ncacherdataset->type == 0);
-	REQUIRE((ncacherdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0);
+	REQUIRE(ncacherdataset->attributes.negative);
 	REQUIRE(name != NULL);
 	REQUIRE(!dns_rdataset_isassociated(rdataset));
 
@@ -659,7 +657,7 @@ dns_ncache_current(dns_rdataset_t *ncacherdataset, dns_name_t *found,
 
 	REQUIRE(ncacherdataset != NULL);
 	REQUIRE(ncacherdataset->type == 0);
-	REQUIRE((ncacherdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0);
+	REQUIRE(ncacherdataset->attributes.negative);
 	REQUIRE(found != NULL);
 	REQUIRE(!dns_rdataset_isassociated(rdataset));
 
diff --git a/lib/dns/order.c b/lib/dns/order.c
index 1c20387a9e..95db8ccceb 100644
--- a/lib/dns/order.c
+++ b/lib/dns/order.c
@@ -32,7 +32,7 @@ struct dns_order_ent {
 	dns_fixedname_t name;
 	dns_rdataclass_t rdclass;
 	dns_rdatatype_t rdtype;
-	unsigned int mode;
+	dns_orderopt_t mode;
 	ISC_LINK(dns_order_ent_t) link;
 };
 
@@ -66,14 +66,10 @@ dns_order_create(isc_mem_t *mctx, dns_order_t **orderp) {
 void
 dns_order_add(dns_order_t *order, const dns_name_t *name,
 	      dns_rdatatype_t rdtype, dns_rdataclass_t rdclass,
-	      unsigned int mode) {
+	      dns_orderopt_t mode) {
 	dns_order_ent_t *ent = NULL;
 
 	REQUIRE(DNS_ORDER_VALID(order));
-	REQUIRE(mode == DNS_RDATASETATTR_RANDOMIZE ||
-		mode == DNS_RDATASETATTR_FIXEDORDER ||
-		mode == DNS_RDATASETATTR_CYCLIC ||
-		mode == DNS_RDATASETATTR_NONE);
 
 	ent = isc_mem_get(order->mctx, sizeof(*ent));
 	*ent = (dns_order_ent_t){
@@ -97,7 +93,7 @@ match(const dns_name_t *name1, const dns_name_t *name2) {
 	return dns_name_equal(name1, name2);
 }
 
-unsigned int
+dns_orderopt_t
 dns_order_find(dns_order_t *order, const dns_name_t *name,
 	       dns_rdatatype_t rdtype, dns_rdataclass_t rdclass) {
 	REQUIRE(DNS_ORDER_VALID(order));
@@ -115,7 +111,7 @@ dns_order_find(dns_order_t *order, const dns_name_t *name,
 			return ent->mode;
 		}
 	}
-	return DNS_RDATASETATTR_NONE;
+	return dns_order_none;
 }
 
 void
diff --git a/lib/dns/qpcache.c b/lib/dns/qpcache.c
index 1716d55535..5bc516728a 100644
--- a/lib/dns/qpcache.c
+++ b/lib/dns/qpcache.c
@@ -1013,16 +1013,16 @@ bindrdataset(qpcache_t *qpdb, qpcnode_t *node, dns_slabheader_t *header,
 	rdataset->resign = 0;
 
 	if (NEGATIVE(header)) {
-		rdataset->attributes |= DNS_RDATASETATTR_NEGATIVE;
+		rdataset->attributes.negative = true;
 	}
 	if (NXDOMAIN(header)) {
-		rdataset->attributes |= DNS_RDATASETATTR_NXDOMAIN;
+		rdataset->attributes.nxdomain = true;
 	}
 	if (OPTOUT(header)) {
-		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
+		rdataset->attributes.optout = true;
 	}
 	if (PREFETCH(header)) {
-		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
+		rdataset->attributes.prefetch = true;
 	}
 
 	if (stale && !ancient) {
@@ -1033,12 +1033,12 @@ bindrdataset(qpcache_t *qpdb, qpcnode_t *node, dns_slabheader_t *header,
 			rdataset->ttl = 0;
 		}
 		if (STALE_WINDOW(header)) {
-			rdataset->attributes |= DNS_RDATASETATTR_STALE_WINDOW;
+			rdataset->attributes.stale_window = true;
 		}
-		rdataset->attributes |= DNS_RDATASETATTR_STALE;
+		rdataset->attributes.stale = true;
 		rdataset->expire = header->expire;
 	} else if (!ACTIVE(header, now)) {
-		rdataset->attributes |= DNS_RDATASETATTR_ANCIENT;
+		rdataset->attributes.ancient = true;
 		rdataset->ttl = 0;
 	}
 
@@ -1055,11 +1055,11 @@ bindrdataset(qpcache_t *qpdb, qpcnode_t *node, dns_slabheader_t *header,
 	 */
 	rdataset->slab.noqname = header->noqname;
 	if (header->noqname != NULL) {
-		rdataset->attributes |= DNS_RDATASETATTR_NOQNAME;
+		rdataset->attributes.noqname = true;
 	}
 	rdataset->slab.closest = header->closest;
 	if (header->closest != NULL) {
-		rdataset->attributes |= DNS_RDATASETATTR_CLOSEST;
+		rdataset->attributes.closest = true;
 	}
 }
 
@@ -2962,19 +2962,19 @@ qpcache_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 
 	atomic_init(&newheader->count,
 		    atomic_fetch_add_relaxed(&init_count, 1));
-	if ((rdataset->attributes & DNS_RDATASETATTR_PREFETCH) != 0) {
+	if (rdataset->attributes.prefetch) {
 		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_PREFETCH);
 	}
-	if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+	if (rdataset->attributes.negative) {
 		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_NEGATIVE);
 	}
-	if ((rdataset->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) {
+	if (rdataset->attributes.nxdomain) {
 		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_NXDOMAIN);
 	}
-	if ((rdataset->attributes & DNS_RDATASETATTR_OPTOUT) != 0) {
+	if (rdataset->attributes.optout) {
 		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_OPTOUT);
 	}
-	if ((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0) {
+	if (rdataset->attributes.noqname) {
 		result = addnoqname(qpdb->common.mctx, newheader,
 				    qpdb->maxrrperset, rdataset);
 		if (result != ISC_R_SUCCESS) {
@@ -2982,7 +2982,7 @@ qpcache_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 			return result;
 		}
 	}
-	if ((rdataset->attributes & DNS_RDATASETATTR_CLOSEST) != 0) {
+	if (rdataset->attributes.closest) {
 		result = addclosest(qpdb->common.mctx, newheader,
 				    qpdb->maxrrperset, rdataset);
 		if (result != ISC_R_SUCCESS) {
diff --git a/lib/dns/qpzone.c b/lib/dns/qpzone.c
index 13fa4e7e20..75adb24ec2 100644
--- a/lib/dns/qpzone.c
+++ b/lib/dns/qpzone.c
@@ -1058,7 +1058,7 @@ bindrdataset(qpzonedb_t *qpdb, qpznode_t *node, dns_slabheader_t *header,
 	rdataset->trust = header->trust;
 
 	if (OPTOUT(header)) {
-		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
+		rdataset->attributes.optout = true;
 	}
 
 	rdataset->count = atomic_fetch_add_relaxed(&header->count, 1);
@@ -1074,18 +1074,18 @@ bindrdataset(qpzonedb_t *qpdb, qpznode_t *node, dns_slabheader_t *header,
 	 */
 	rdataset->slab.noqname = header->noqname;
 	if (header->noqname != NULL) {
-		rdataset->attributes |= DNS_RDATASETATTR_NOQNAME;
+		rdataset->attributes.noqname = true;
 	}
 	rdataset->slab.closest = header->closest;
 	if (header->closest != NULL) {
-		rdataset->attributes |= DNS_RDATASETATTR_CLOSEST;
+		rdataset->attributes.closest = true;
 	}
 
 	/*
 	 * Copy out re-signing information.
 	 */
 	if (RESIGN(header)) {
-		rdataset->attributes |= DNS_RDATASETATTR_RESIGN;
+		rdataset->attributes.resign = true;
 		rdataset->resign = (header->resign << 1) | header->resign_lsb;
 	} else {
 		rdataset->resign = 0;
@@ -2228,7 +2228,7 @@ loading_addrdataset(void *arg, const dns_name_t *name,
 
 	dns_slabheader_setownercase(newheader, name);
 
-	if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
+	if (rdataset->attributes.resign) {
 		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_RESIGN);
 		newheader->resign =
 			(isc_stdtime_t)(dns_time64_from32(rdataset->resign) >>
@@ -4745,7 +4745,7 @@ qpzone_addrdataset(dns_db_t *db, dns_dbnode_t *dbnode,
 		    atomic_fetch_add_relaxed(&init_count, 1));
 
 	newheader->serial = version->serial;
-	if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
+	if (rdataset->attributes.resign) {
 		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_RESIGN);
 		newheader->resign =
 			(isc_stdtime_t)(dns_time64_from32(rdataset->resign) >>
@@ -4857,7 +4857,7 @@ qpzone_subtractrdataset(dns_db_t *db, dns_dbnode_t *dbnode,
 	newheader->serial = version->serial;
 	atomic_init(&newheader->count,
 		    atomic_fetch_add_relaxed(&init_count, 1));
-	if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
+	if (rdataset->attributes.resign) {
 		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_RESIGN);
 		newheader->resign =
 			(isc_stdtime_t)(dns_time64_from32(rdataset->resign) >>
@@ -5161,7 +5161,7 @@ glue_nsdname_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype,
 
 	/*
 	 * If the currently processed NS record is in-bailiwick, mark any glue
-	 * RRsets found for it with DNS_RDATASETATTR_REQUIRED.  Note that for
+	 * RRsets found for it with 'required' attribute.  Note that for
 	 * simplicity, glue RRsets for all in-bailiwick NS records are marked
 	 * this way, even though dns_message_rendersection() only checks the
 	 * attributes for the first rdataset associated with the first name
@@ -5169,12 +5169,10 @@ glue_nsdname_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype,
 	 */
 	if (glue != NULL && dns_name_issubdomain(name, &node->name)) {
 		if (dns_rdataset_isassociated(&glue->rdataset_a)) {
-			glue->rdataset_a.attributes |=
-				DNS_RDATASETATTR_REQUIRED;
+			glue->rdataset_a.attributes.required = true;
 		}
 		if (dns_rdataset_isassociated(&glue->rdataset_aaaa)) {
-			glue->rdataset_aaaa.attributes |=
-				DNS_RDATASETATTR_REQUIRED;
+			glue->rdataset_aaaa.attributes.required = true;
 		}
 	}
 
@@ -5212,7 +5210,7 @@ glue_nsdname_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype,
 	return result;
 }
 
-#define IS_REQUIRED_GLUE(r) (((r)->attributes & DNS_RDATASETATTR_REQUIRED) != 0)
+#define IS_REQUIRED_GLUE(r) (((r)->attributes.required))
 
 static void
 addglue_to_message(dns_glue_t *ge, dns_message_t *msg) {
diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c
index db6251285c..ac286c64b3 100644
--- a/lib/dns/rdatalist.c
+++ b/lib/dns/rdatalist.c
@@ -215,7 +215,7 @@ dns_rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
 		ttl = negsig->ttl;
 	}
 	rdataset->ttl = neg->ttl = negsig->ttl = ttl;
-	rdataset->attributes |= DNS_RDATASETATTR_NOQNAME;
+	rdataset->attributes.noqname = true;
 	rdataset->rdlist.noqname = name;
 	return ISC_R_SUCCESS;
 }
@@ -230,7 +230,7 @@ dns_rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 	dns_name_t *noqname = NULL;
 
 	REQUIRE(rdataset != NULL);
-	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0);
+	REQUIRE(rdataset->attributes.noqname);
 
 	rdclass = rdataset->rdclass;
 	noqname = rdataset->rdlist.noqname;
@@ -312,7 +312,7 @@ dns_rdatalist_addclosest(dns_rdataset_t *rdataset, dns_name_t *name) {
 		ttl = negsig->ttl;
 	}
 	rdataset->ttl = neg->ttl = negsig->ttl = ttl;
-	rdataset->attributes |= DNS_RDATASETATTR_CLOSEST;
+	rdataset->attributes.closest = true;
 	rdataset->rdlist.closest = name;
 	return ISC_R_SUCCESS;
 }
@@ -327,7 +327,7 @@ dns_rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
 	dns_name_t *closest = NULL;
 
 	REQUIRE(rdataset != NULL);
-	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_CLOSEST) != 0);
+	REQUIRE(rdataset->attributes.closest);
 
 	rdclass = rdataset->rdclass;
 	closest = rdataset->rdlist.closest;
diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
index b57f61a2b8..56babead7b 100644
--- a/lib/dns/rdataset.c
+++ b/lib/dns/rdataset.c
@@ -29,6 +29,7 @@
 #include <dns/ncache.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
+#include <dns/types.h>
 
 static const char *trustnames[] = {
 	"none",		  "pending-additional",
@@ -141,7 +142,7 @@ dns_rdataset_makequestion(dns_rdataset_t *rdataset, dns_rdataclass_t rdclass,
 	rdataset->methods = &question_methods;
 	rdataset->rdclass = rdclass;
 	rdataset->type = type;
-	rdataset->attributes |= DNS_RDATASETATTR_QUESTION;
+	rdataset->attributes.question = true;
 }
 
 unsigned int
@@ -208,9 +209,8 @@ dns_rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 }
 
 #define MAX_SHUFFLE    32
-#define WANT_FIXED(r)  (((r)->attributes & DNS_RDATASETATTR_FIXEDORDER) != 0)
-#define WANT_RANDOM(r) (((r)->attributes & DNS_RDATASETATTR_RANDOMIZE) != 0)
-#define WANT_CYCLIC(r) (((r)->attributes & DNS_RDATASETATTR_CYCLIC) != 0)
+#define WANT_RANDOM(r) (((r)->attributes.order == dns_order_randomize))
+#define WANT_CYCLIC(r) (((r)->attributes.order == dns_order_cyclic))
 
 struct towire_sort {
 	int key;
@@ -257,12 +257,12 @@ towire(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 	want_random = WANT_RANDOM(rdataset);
 	want_cyclic = WANT_CYCLIC(rdataset);
 
-	if ((rdataset->attributes & DNS_RDATASETATTR_QUESTION) != 0) {
+	if (rdataset->attributes.question) {
 		question = true;
 		count = 1;
 		result = dns_rdataset_first(rdataset);
 		INSIST(result == ISC_R_NOMORE);
-	} else if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+	} else if (rdataset->attributes.negative) {
 		/*
 		 * This is a negative caching rdataset.
 		 */
@@ -481,7 +481,7 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
 	 */
 
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
-	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
+	REQUIRE(!rdataset->attributes.question);
 
 	if (limit != 0 && dns_rdataset_count(rdataset) > limit) {
 		return DNS_R_TOOMANYRECORDS;
@@ -586,7 +586,7 @@ dns_rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	REQUIRE(rdataset->methods != NULL);
 
 	if (rdataset->methods->setownercase != NULL &&
-	    (rdataset->attributes & DNS_RDATASETATTR_KEEPCASE) == 0)
+	    !rdataset->attributes.keepcase)
 	{
 		(rdataset->methods->setownercase)(rdataset, name);
 	}
@@ -598,7 +598,7 @@ dns_rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
 	REQUIRE(rdataset->methods != NULL);
 
 	if (rdataset->methods->getownercase != NULL &&
-	    (rdataset->attributes & DNS_RDATASETATTR_KEEPCASE) == 0)
+	    !rdataset->attributes.keepcase)
 	{
 		(rdataset->methods->getownercase)(rdataset, name);
 	}
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index 888f14f3dd..8f796e4608 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -1099,9 +1099,10 @@ rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 		.slab.raw = noqname->neg,
 		.link = nsec->link,
 		.count = nsec->count,
-		.attributes = nsec->attributes | DNS_RDATASETATTR_KEEPCASE,
+		.attributes = nsec->attributes,
 		.magic = nsec->magic,
 	};
+	nsec->attributes.keepcase = true;
 
 	dns__db_attachnode(db, node,
 			   &(dns_dbnode_t *){ NULL } DNS__DB_FLARG_PASS);
@@ -1117,9 +1118,10 @@ rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 		.slab.raw = noqname->negsig,
 		.link = nsecsig->link,
 		.count = nsecsig->count,
-		.attributes = nsecsig->attributes | DNS_RDATASETATTR_KEEPCASE,
+		.attributes = nsecsig->attributes,
 		.magic = nsecsig->magic,
 	};
+	nsecsig->attributes.keepcase = true;
 
 	dns_name_clone(&noqname->name, name);
 
@@ -1152,9 +1154,10 @@ rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
 		.slab.raw = closest->neg,
 		.link = nsec->link,
 		.count = nsec->count,
-		.attributes = nsec->attributes | DNS_RDATASETATTR_KEEPCASE,
+		.attributes = nsec->attributes,
 		.magic = nsec->magic,
 	};
+	nsec->attributes.keepcase = true;
 
 	dns__db_attachnode(db, node,
 			   &(dns_dbnode_t *){ NULL } DNS__DB_FLARG_PASS);
@@ -1170,9 +1173,10 @@ rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
 		.slab.raw = closest->negsig,
 		.link = nsecsig->link,
 		.count = nsecsig->count,
-		.attributes = nsecsig->attributes | DNS_RDATASETATTR_KEEPCASE,
+		.attributes = nsecsig->attributes,
 		.magic = nsecsig->magic,
 	};
+	nsecsig->attributes.keepcase = true;
 
 	dns_name_clone(&closest->name, name);
 
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index a483cc8ea8..be506e505b 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -629,9 +629,9 @@ enum {
 #define BADCOOKIE(a)   (((a)->flags & FCTX_ADDRINFO_BADCOOKIE) != 0)
 #define ISDUALSTACK(a) (((a)->flags & FCTX_ADDRINFO_DUALSTACK) != 0)
 
-#define NXDOMAIN(r)   (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
-#define NEGATIVE(r)   (((r)->attributes & DNS_RDATASETATTR_NEGATIVE) != 0)
-#define STATICSTUB(r) (((r)->attributes & DNS_RDATASETATTR_STATICSTUB) != 0)
+#define NXDOMAIN(r)   (((r)->attributes.nxdomain))
+#define NEGATIVE(r)   (((r)->attributes.negative))
+#define STATICSTUB(r) (((r)->attributes.staticstub))
 
 #ifdef ENABLE_AFL
 bool dns_fuzzing_resolver = false;
@@ -5052,13 +5052,13 @@ clone_results(fetchctx_t *fctx) {
 	}
 }
 
-#define CACHE(r)      (((r)->attributes & DNS_RDATASETATTR_CACHE) != 0)
-#define ANSWER(r)     (((r)->attributes & DNS_RDATASETATTR_ANSWER) != 0)
-#define ANSWERSIG(r)  (((r)->attributes & DNS_RDATASETATTR_ANSWERSIG) != 0)
-#define EXTERNAL(r)   (((r)->attributes & DNS_RDATASETATTR_EXTERNAL) != 0)
-#define CHAINING(r)   (((r)->attributes & DNS_RDATASETATTR_CHAINING) != 0)
-#define CHASE(r)      (((r)->attributes & DNS_RDATASETATTR_CHASE) != 0)
-#define CHECKNAMES(r) (((r)->attributes & DNS_RDATASETATTR_CHECKNAMES) != 0)
+#define CACHE(r)      (((r)->attributes.cache))
+#define ANSWER(r)     (((r)->attributes.answer))
+#define ANSWERSIG(r)  (((r)->attributes.answersig))
+#define EXTERNAL(r)   (((r)->attributes.external))
+#define CHAINING(r)   (((r)->attributes.chaining))
+#define CHASE(r)      (((r)->attributes.chase))
+#define CHECKNAMES(r) (((r)->attributes.checknames))
 
 /*
  * Cancel validators associated with '*fctx' if it is ready to be
@@ -5953,7 +5953,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 		 * Mark the rdataset as being prefetch eligible.
 		 */
 		if (rdataset->ttl >= fctx->res->view->prefetch_eligible) {
-			rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
+			rdataset->attributes.prefetch = true;
 		}
 
 		/*
@@ -6016,8 +6016,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 			 */
 			if (rdataset->ttl >= fctx->res->view->prefetch_eligible)
 			{
-				rdataset->attributes |=
-					DNS_RDATASETATTR_PREFETCH;
+				rdataset->attributes.prefetch = true;
 			}
 
 			/*
@@ -6584,11 +6583,11 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
 	 */
 	if (!CACHE(rdataset)) {
 		name->attributes.chase = true;
-		rdataset->attributes |= DNS_RDATASETATTR_CHASE;
+		rdataset->attributes.chase = true;
 	}
-	rdataset->attributes |= DNS_RDATASETATTR_CACHE;
+	rdataset->attributes.cache = true;
 	if (external) {
-		rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL;
+		rdataset->attributes.external = true;
 	}
 }
 
@@ -7154,8 +7153,7 @@ checknamessection(dns_message_t *message, dns_section_t section) {
 							  rdata.type, false) ||
 				    !dns_rdata_checknames(&rdata, name, NULL))
 				{
-					rdataset->attributes |=
-						DNS_RDATASETATTR_CHECKNAMES;
+					rdataset->attributes.checknames = true;
 				}
 			}
 		}
@@ -8489,8 +8487,8 @@ rctx_answer_any(respctx_t *rctx) {
 
 		rctx->aname->attributes.cache = true;
 		rctx->aname->attributes.answer = true;
-		rdataset->attributes |= DNS_RDATASETATTR_ANSWER;
-		rdataset->attributes |= DNS_RDATASETATTR_CACHE;
+		rdataset->attributes.answer = true;
+		rdataset->attributes.cache = true;
 		rdataset->trust = rctx->trust;
 	}
 
@@ -8532,8 +8530,8 @@ rctx_answer_match(respctx_t *rctx) {
 
 	rctx->aname->attributes.cache = true;
 	rctx->aname->attributes.answer = true;
-	rctx->ardataset->attributes |= DNS_RDATASETATTR_ANSWER;
-	rctx->ardataset->attributes |= DNS_RDATASETATTR_CACHE;
+	rctx->ardataset->attributes.answer = true;
+	rctx->ardataset->attributes.cache = true;
 	rctx->ardataset->trust = rctx->trust;
 	(void)dns_rdataset_additionaldata(rctx->ardataset, rctx->aname,
 					  check_related, rctx,
@@ -8551,8 +8549,8 @@ rctx_answer_match(respctx_t *rctx) {
 			continue;
 		}
 
-		sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG;
-		sigrdataset->attributes |= DNS_RDATASETATTR_CACHE;
+		sigrdataset->attributes.answersig = true;
+		sigrdataset->attributes.cache = true;
 		sigrdataset->trust = rctx->trust;
 		break;
 	}
@@ -8594,9 +8592,9 @@ rctx_answer_cname(respctx_t *rctx) {
 	rctx->cname->attributes.cache = true;
 	rctx->cname->attributes.answer = true;
 	rctx->cname->attributes.chaining = true;
-	rctx->crdataset->attributes |= DNS_RDATASETATTR_ANSWER;
-	rctx->crdataset->attributes |= DNS_RDATASETATTR_CACHE;
-	rctx->crdataset->attributes |= DNS_RDATASETATTR_CHAINING;
+	rctx->crdataset->attributes.answer = true;
+	rctx->crdataset->attributes.cache = true;
+	rctx->crdataset->attributes.chaining = true;
 	rctx->crdataset->trust = rctx->trust;
 
 	ISC_LIST_FOREACH (rctx->cname->list, sigrdataset, link) {
@@ -8611,8 +8609,8 @@ rctx_answer_cname(respctx_t *rctx) {
 			continue;
 		}
 
-		sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG;
-		sigrdataset->attributes |= DNS_RDATASETATTR_CACHE;
+		sigrdataset->attributes.answersig = true;
+		sigrdataset->attributes.cache = true;
 		sigrdataset->trust = rctx->trust;
 		break;
 	}
@@ -8644,9 +8642,9 @@ rctx_answer_dname(respctx_t *rctx) {
 	rctx->dname->attributes.cache = true;
 	rctx->dname->attributes.answer = true;
 	rctx->dname->attributes.chaining = true;
-	rctx->drdataset->attributes |= DNS_RDATASETATTR_ANSWER;
-	rctx->drdataset->attributes |= DNS_RDATASETATTR_CACHE;
-	rctx->drdataset->attributes |= DNS_RDATASETATTR_CHAINING;
+	rctx->drdataset->attributes.answer = true;
+	rctx->drdataset->attributes.cache = true;
+	rctx->drdataset->attributes.chaining = true;
 	rctx->drdataset->trust = rctx->trust;
 
 	ISC_LIST_FOREACH (rctx->dname->list, sigrdataset, link) {
@@ -8661,8 +8659,8 @@ rctx_answer_dname(respctx_t *rctx) {
 			continue;
 		}
 
-		sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG;
-		sigrdataset->attributes |= DNS_RDATASETATTR_CACHE;
+		sigrdataset->attributes.answersig = true;
+		sigrdataset->attributes.cache = true;
 		sigrdataset->trust = rctx->trust;
 		break;
 	}
@@ -8698,8 +8696,7 @@ rctx_authority_positive(respctx_t *rctx) {
 				     rdataset->covers == dns_rdatatype_ns))
 				{
 					name->attributes.cache = true;
-					rdataset->attributes |=
-						DNS_RDATASETATTR_CACHE;
+					rdataset->attributes.cache = true;
 
 					if (rctx->aa) {
 						rdataset->trust =
@@ -8933,7 +8930,7 @@ rctx_authority_negative(respctx_t *rctx) {
 					rctx->ns_rdataset = rdataset;
 				}
 				name->attributes.cache = true;
-				rdataset->attributes |= DNS_RDATASETATTR_CACHE;
+				rdataset->attributes.cache = true;
 				rdataset->trust = dns_trust_glue;
 				break;
 			case dns_rdatatype_soa:
@@ -8957,7 +8954,7 @@ rctx_authority_negative(respctx_t *rctx) {
 					rctx->soa_name = name;
 				}
 				name->attributes.ncache = true;
-				rdataset->attributes |= DNS_RDATASETATTR_NCACHE;
+				rdataset->attributes.ncache = true;
 				if (rctx->aa) {
 					rdataset->trust =
 						dns_trust_authauthority;
@@ -9049,12 +9046,10 @@ rctx_authority_dnssec(respctx_t *rctx) {
 			case dns_rdatatype_nsec3:
 				if (rctx->negative) {
 					name->attributes.ncache = true;
-					rdataset->attributes |=
-						DNS_RDATASETATTR_NCACHE;
+					rdataset->attributes.ncache = true;
 				} else if (type == dns_rdatatype_nsec) {
 					name->attributes.cache = true;
-					rdataset->attributes |=
-						DNS_RDATASETATTR_CACHE;
+					rdataset->attributes.cache = true;
 				}
 
 				if (rctx->aa) {
@@ -9100,7 +9095,7 @@ rctx_authority_dnssec(respctx_t *rctx) {
 				}
 
 				name->attributes.cache = true;
-				rdataset->attributes |= DNS_RDATASETATTR_CACHE;
+				rdataset->attributes.cache = true;
 
 				if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) {
 					checknta = false;
@@ -9286,7 +9281,7 @@ again:
 		name->attributes.chase = false;
 		ISC_LIST_FOREACH (name->list, rdataset, link) {
 			if (CHASE(rdataset)) {
-				rdataset->attributes &= ~DNS_RDATASETATTR_CHASE;
+				rdataset->attributes.chase = false;
 				(void)dns_rdataset_additionaldata(
 					rdataset, name, check_related, rctx,
 					DNS_RDATASET_MAXADDITIONAL);
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 82a839977a..2d044ccdfc 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -115,8 +115,8 @@ enum valattr {
 #define OFFLOADED(v) (((v)->attributes & VALATTR_OFFLOADED) != 0)
 #define COMPLETE(v)  (((v)->attributes & VALATTR_COMPLETE) != 0)
 
-#define NEGATIVE(r) (((r)->attributes & DNS_RDATASETATTR_NEGATIVE) != 0)
-#define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
+#define NEGATIVE(r) (((r)->attributes.negative))
+#define NXDOMAIN(r) (((r)->attributes.nxdomain))
 
 #define MAXVALIDATIONS(r) (((r)->attributes & VALATTR_MAXVALIDATIONS) != 0)
 #define MAXVALIDATIONFAILS(r) \
diff --git a/lib/dns/view.c b/lib/dns/view.c
index 5332fed5a1..1122398f95 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -1110,7 +1110,7 @@ db_find:
 		 * addresses we use the configured server addresses.
 		 */
 		if (dns_zone_gettype(zone) == dns_zone_staticstub) {
-			rdataset->attributes |= DNS_RDATASETATTR_STATICSTUB;
+			rdataset->attributes.staticstub = true;
 		}
 
 		if (use_cache && view->cachedb != NULL && db != view->hints) {
diff --git a/lib/ns/query.c b/lib/ns/query.c
index fed3171636..677c388bd8 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -148,13 +148,13 @@
 #define QUERY_STALETIMEOUT(q) (((q)->dboptions & DNS_DBFIND_STALETIMEOUT) != 0)
 
 /*% Does the rdataset 'r' have an attached 'No QNAME Proof'? */
-#define NOQNAME(r) (((r)->attributes & DNS_RDATASETATTR_NOQNAME) != 0)
+#define NOQNAME(r) (((r)->attributes.noqname))
 
 /*% Does the rdataset 'r' contain a stale answer? */
-#define STALE(r) (((r)->attributes & DNS_RDATASETATTR_STALE) != 0)
+#define STALE(r) (((r)->attributes.stale))
 
 /*% Does the rdataset 'r' is stale and within stale-refresh-time? */
-#define STALE_WINDOW(r) (((r)->attributes & DNS_RDATASETATTR_STALE_WINDOW) != 0)
+#define STALE_WINDOW(r) (((r)->attributes.stale_window))
 
 #ifdef WANT_QUERYTRACE
 static void
@@ -511,9 +511,6 @@ query_addwildcardproof(query_ctx_t *qctx, bool ispositive, bool nodata);
 static void
 query_addauth(query_ctx_t *qctx);
 
-static void
-query_clear_stale(ns_client_t *client);
-
 /*
  * Increment query statistics counters.
  */
@@ -2179,7 +2176,7 @@ query_setorder(query_ctx_t *qctx, dns_name_t *name, dns_rdataset_t *rdataset) {
 	UNUSED(client);
 
 	if (order != NULL) {
-		rdataset->attributes |= dns_order_find(
+		rdataset->attributes.order = dns_order_find(
 			order, name, rdataset->type, rdataset->rdclass);
 	}
 }
@@ -2269,12 +2266,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
 		if (dbuf != NULL) {
 			ns_client_releasename(client, namep);
 		}
-		if ((rdataset->attributes & DNS_RDATASETATTR_REQUIRED) != 0) {
-			mrdataset->attributes |= DNS_RDATASETATTR_REQUIRED;
+		if (rdataset->attributes.required) {
+			mrdataset->attributes.required = true;
 		}
-		if ((rdataset->attributes & DNS_RDATASETATTR_STALE_ADDED) != 0)
-		{
-			mrdataset->attributes |= DNS_RDATASETATTR_STALE_ADDED;
+		if (rdataset->attributes.stale_added) {
+			mrdataset->attributes.stale_added = true;
 		}
 		return;
 	} else if (result == DNS_R_NXDOMAIN) {
@@ -2826,7 +2822,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	if (FETCH_RECTYPE_PREFETCH(client) != NULL ||
 	    client->inner.view->prefetch_trigger == 0U ||
 	    rdataset->ttl > client->inner.view->prefetch_trigger ||
-	    (rdataset->attributes & DNS_RDATASETATTR_PREFETCH) == 0)
+	    !rdataset->attributes.prefetch)
 	{
 		return;
 	}
@@ -4364,7 +4360,7 @@ rpz_ck_dnssec(ns_client_t *client, isc_result_t qresult,
 	/*
 	 * Look for a signature in a negative cache rdataset.
 	 */
-	if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) == 0) {
+	if (!rdataset->attributes.negative) {
 		return true;
 	}
 	found = dns_fixedname_initname(&fixed);
@@ -4715,7 +4711,7 @@ redirect(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 		{
 			return ISC_R_NOTFOUND;
 		}
-		if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+		if (rdataset->attributes.negative) {
 			DNS_RDATASET_FOREACH (rdataset) {
 				dns_ncache_current(rdataset, found, &trdataset);
 				type = trdataset.type;
@@ -4849,7 +4845,7 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 		{
 			return ISC_R_NOTFOUND;
 		}
-		if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+		if (rdataset->attributes.negative) {
 			DNS_RDATASET_FOREACH (rdataset) {
 				dns_ncache_current(rdataset, found, &trdataset);
 				type = trdataset.type;
@@ -5987,7 +5983,7 @@ query_lookup(query_ctx_t *qctx) {
 		 * clean it up if needed when we resume from recursion.
 		 */
 		qctx->client->query.attributes |= NS_QUERYATTR_STALEOK;
-		qctx->rdataset->attributes |= DNS_RDATASETATTR_STALE_ADDED;
+		qctx->rdataset->attributes.stale_added = true;
 	}
 
 	result = query_gotanswer(qctx, result);
@@ -5997,11 +5993,11 @@ cleanup:
 }
 
 /*
- * Clear all rdatasets from the message that are in the given section and
- * that have the 'attr' attribute set.
+ * Clear all rdatasets from the message, or only those with stale_added
+ * attribute set.
  */
 static void
-message_clearrdataset(dns_message_t *msg, unsigned int attr) {
+message_clearrdataset(dns_message_t *msg, bool stale_only) {
 	unsigned int i;
 
 	/*
@@ -6010,7 +6006,8 @@ message_clearrdataset(dns_message_t *msg, unsigned int attr) {
 	for (i = DNS_SECTION_ANSWER; i < DNS_SECTION_MAX; i++) {
 		ISC_LIST_FOREACH (msg->sections[i], name, link) {
 			ISC_LIST_FOREACH (name->list, rds, link) {
-				if ((rds->attributes & attr) != attr) {
+				if (stale_only && !rds->attributes.stale_added)
+				{
 					continue;
 				}
 				ISC_LIST_UNLINK(name->list, rds, link);
@@ -6030,15 +6027,6 @@ message_clearrdataset(dns_message_t *msg, unsigned int attr) {
 	}
 }
 
-/*
- * Clear any rdatasets from the client's message that were added on a lookup
- * due to a client timeout.
- */
-static void
-query_clear_stale(ns_client_t *client) {
-	message_clearrdataset(client->message, DNS_RDATASETATTR_STALE_ADDED);
-}
-
 /*
  * Event handler to resume processing a query after recursion, or when a
  * client timeout is triggered. If the query has timed out or been cancelled
@@ -6900,8 +6888,7 @@ query_checkrrl(query_ctx_t *qctx, isc_result_t result) {
 		} else if (result == DNS_R_NCACHENXDOMAIN &&
 			   qctx->rdataset != NULL &&
 			   dns_rdataset_isassociated(qctx->rdataset) &&
-			   (qctx->rdataset->attributes &
-			    DNS_RDATASETATTR_NEGATIVE) != 0)
+			   qctx->rdataset->attributes.negative)
 		{
 			/*
 			 * Try to use owner name in the negative cache SOA.
@@ -7590,7 +7577,7 @@ query_addnoqnameproof(query_ctx_t *qctx) {
 	query_addrrset(qctx, &fname, &neg, &negsig, dbuf,
 		       DNS_SECTION_AUTHORITY);
 
-	if ((qctx->noqname->attributes & DNS_RDATASETATTR_CLOSEST) == 0) {
+	if (!qctx->noqname->attributes.closest) {
 		goto cleanup;
 	}
 
@@ -7967,7 +7954,11 @@ query_addanswer(query_ctx_t *qctx) {
 	    !QUERY_STALETIMEOUT(&qctx->client->query) && !qctx->refresh_rrset)
 	{
 		CCTRACE(ISC_LOG_DEBUG(3), "query_clear_stale");
-		query_clear_stale(qctx->client);
+		/*
+		 * Clear any rdatasets from the client's message that were added
+		 * on a lookup due to a client timeout.
+		 */
+		message_clearrdataset(qctx->client->message, true);
 		/*
 		 * We can clear the attribute to prevent redundant clearing
 		 * in subsequent lookups.
@@ -10544,7 +10535,7 @@ query_addsoa(query_ctx_t *qctx, unsigned int override_ttl,
 		}
 
 		if (section == DNS_SECTION_ADDITIONAL) {
-			rdataset->attributes |= DNS_RDATASETATTR_REQUIRED;
+			rdataset->attributes.required = true;
 		}
 		query_addrrset(qctx, &name, &rdataset, sigrdatasetp, NULL,
 			       section);
@@ -11240,8 +11231,7 @@ query_glueanswer(query_ctx_t *qctx) {
 							link);
 					ISC_LIST_PREPEND(name->list, rdataset,
 							 link);
-					rdataset->attributes |=
-						DNS_RDATASETATTR_REQUIRED;
+					rdataset->attributes.required = true;
 					break;
 				}
 			}
@@ -11402,7 +11392,7 @@ ns_query_done(query_ctx_t *qctx) {
 		 * RRsets, clear the RRsets from the message before doing the
 		 * refresh.
 		 */
-		message_clearrdataset(qctx->client->message, 0);
+		message_clearrdataset(qctx->client->message, false);
 		query_stale_refresh(qctx->client);
 	}
 
diff --git a/tests/dns/db_test.c b/tests/dns/db_test.c
index 7fa128b801..7accde8d42 100644
--- a/tests/dns/db_test.c
+++ b/tests/dns/db_test.c
@@ -179,9 +179,7 @@ ISC_LOOP_TEST_IMPL(dns_dbfind_staleok) {
 		do {
 			count++;
 			assert_in_range(count, 1, 21); /* loop sanity */
-			assert_int_equal(rdataset.attributes &
-						 DNS_RDATASETATTR_STALE,
-					 0);
+			assert_int_equal(rdataset.attributes.stale, false);
 			assert_true(rdataset.ttl > 0);
 			dns_db_detachnode(db, &node);
 			dns_rdataset_disassociate(&rdataset);
@@ -215,9 +213,8 @@ ISC_LOOP_TEST_IMPL(dns_dbfind_staleok) {
 				count++;
 				assert_in_range(count, 0, 49); /* loop sanity */
 				assert_int_equal(result, ISC_R_SUCCESS);
-				assert_int_equal(rdataset.attributes &
-							 DNS_RDATASETATTR_STALE,
-						 DNS_RDATASETATTR_STALE);
+				assert_int_equal(rdataset.attributes.stale,
+						 true);
 				dns_db_detachnode(db, &node);
 				dns_rdataset_disassociate(&rdataset);