diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index bb3fefd2ed..0594ed157e 100644
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -677,7 +677,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			usage();
 
diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
index 793169fd42..80cdfb55d3 100644
--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
@@ -426,7 +426,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					prog_name, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			usage();
 
diff --git a/bin/dig/host.c b/bin/dig/host.c
index 775cddf37e..f0617833d8 100644
--- a/bin/dig/host.c
+++ b/bin/dig/host.c
@@ -770,7 +770,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 'A':
 			list_almost_all = true;
-		/* FALL THROUGH */
+			FALLTHROUGH;
 		case 'a':
 			if (!lookup->rdtypeset ||
 			    lookup->rdtype != dns_rdatatype_axfr) {
diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
index 05a8cd4095..fa3ef72d72 100644
--- a/bin/dnssec/dnssec-dsfromkey.c
+++ b/bin/dnssec/dnssec-dsfromkey.c
@@ -434,14 +434,14 @@ main(int argc, char **argv) {
 			}
 			break;
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+			/* Reserved for FIPS mode */
+			FALLTHROUGH;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
index 65cee0f56b..6c1d2f22cd 100644
--- a/bin/dnssec/dnssec-importkey.c
+++ b/bin/dnssec/dnssec-importkey.c
@@ -385,7 +385,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c
index adecfa63e8..233e12bc11 100644
--- a/bin/dnssec/dnssec-keyfromlabel.c
+++ b/bin/dnssec/dnssec-keyfromlabel.c
@@ -315,14 +315,14 @@ main(int argc, char **argv) {
 			prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+			/* Reserved for FIPS mode */
+			FALLTHROUGH;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index c43c0d7dcf..64ad357923 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -1108,14 +1108,14 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+			/* Reserved for FIPS mode */
+			FALLTHROUGH;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
index b464868c3f..36ee75c718 100644
--- a/bin/dnssec/dnssec-revoke.c
+++ b/bin/dnssec/dnssec-revoke.c
@@ -119,7 +119,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
index f7f45ee646..6c78c38966 100644
--- a/bin/dnssec/dnssec-settime.c
+++ b/bin/dnssec/dnssec-settime.c
@@ -342,7 +342,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 8fc6eee5b6..207c861a5d 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -3642,14 +3642,14 @@ main(int argc, char *argv[]) {
 			break;
 
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+			/* Reserved for FIPS mode */
+			FALLTHROUGH;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
index 4d704e7d38..ac2485775b 100644
--- a/bin/dnssec/dnssec-verify.c
+++ b/bin/dnssec/dnssec-verify.c
@@ -132,7 +132,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			      "use -o to specify a different zone origin",
 			      origin, file);
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	default:
 		fatal("failed loading zone from '%s': %s", file,
 		      isc_result_totext(result));
@@ -262,7 +262,7 @@ main(int argc, char *argv[]) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 
 		case 'h':
 			/* Does not return. */
diff --git a/bin/named/main.c b/bin/named/main.c
index 3a2fe05732..e7ed493612 100644
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -860,8 +860,8 @@ parse_command_line(int argc, char *argv[]) {
 			}
 			break;
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+			/* Reserved for FIPS mode */
+			FALLTHROUGH;
 		case '?':
 			usage();
 			if (isc_commandline_option == '?') {
@@ -876,7 +876,7 @@ parse_command_line(int argc, char *argv[]) {
 						      "an argument",
 						      isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 			named_main_earlyfatal("parsing options returned %d",
 					      ch);
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 027b7734c8..55f2f35854 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1874,7 +1874,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setxfracl(zone, none);
 			dns_acl_detach(&none);
 		}
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case dns_zone_secondary:
 	case dns_zone_stub:
 	case dns_zone_redirect:
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
index 949ab609a3..178120d90d 100644
--- a/bin/rndc/rndc.c
+++ b/bin/rndc/rndc.c
@@ -1001,7 +1001,7 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 				usage(1);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			usage(0);
 			break;
diff --git a/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c b/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c
index 1090d780f0..9edcffe9ce 100644
--- a/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c
+++ b/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c
@@ -684,7 +684,7 @@ fnmatch(const char *pattern, const char *string, int flags) {
 					--pattern;
 				}
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 		norm:
 			if (c == *string) {
diff --git a/doc/dev/style.md b/doc/dev/style.md
index f3165f2a36..3a71b85995 100644
--- a/doc/dev/style.md
+++ b/doc/dev/style.md
@@ -145,7 +145,7 @@ Good:
 The following lint and lint-like comments should be used where appropriate:
 
     	/* ARGSUSED */
-    	/* FALLTHROUGH */
+    	FALLTHROUGH;
     	/* NOTREACHED */
     	/* VARARGS */
 
diff --git a/lib/bind9/getaddresses.c b/lib/bind9/getaddresses.c
index 5395540631..6ce32d7a9b 100644
--- a/lib/bind9/getaddresses.c
+++ b/lib/bind9/getaddresses.c
@@ -132,7 +132,7 @@ again:
 			goto again;
 		}
 #endif /* ifdef AI_ADDRCONFIG */
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	default:
 		return (ISC_R_FAILURE);
 	}
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 81e2f0658d..0fcac79d3c 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -801,7 +801,7 @@ tcp_recv(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region,
 		}
 
 		/* Got an invalid DNS response, terminate the connection */
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	default:
 		isc_sockaddr_format(&peer, buf, sizeof(buf));
 		dispatch_log(disp, ISC_LOG_ERROR,
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 3ed6f6c0e4..171b6b3ed4 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -441,7 +441,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 			inc_stat(dns_dnssecstats_fail);
 			return (DNS_R_SIGINVALID);
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	default:
 		if (!dns_name_issubdomain(name, &sig.signer)) {
 			inc_stat(dns_dnssecstats_fail);
diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index ccd787d129..44e5f6e160 100644
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -816,7 +816,7 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype, isc_sockaddr_t *qaddr,
 			break;
 		}
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case DNS_DTTYPE_AQ:
 	case DNS_DTTYPE_CQ:
 	case DNS_DTTYPE_FQ:
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index 060cc86ec2..ae2e815c86 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -703,7 +703,7 @@ rdataset_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 				isc_buffer_putstr(target, KEYDATA);
 				break;
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 			if ((ctx->style.flags & DNS_STYLEFLAG_UNKNOWNFORMAT) !=
 			    0) {
diff --git a/lib/dns/name.c b/lib/dns/name.c
index e357228d35..2a8f9a5d77 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -1145,7 +1145,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 				break;
 			}
 
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case ft_start:
 			label = ndata;
 			ndata++;
@@ -1160,7 +1160,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			if (nrem == 0) {
 				return (ISC_R_NOSPACE);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case ft_ordinary:
 			if (c == '.') {
 				if (count == 0) {
@@ -1204,7 +1204,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			}
 			state = ft_escape;
 			POST(state);
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case ft_escape:
 			if (!isdigit((unsigned char)c)) {
 				if (count >= 63) {
@@ -1224,7 +1224,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			digits = 0;
 			value = 0;
 			state = ft_escdecimal;
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case ft_escdecimal:
 			if (!isdigit((unsigned char)c)) {
 				return (DNS_R_BADESCAPE);
@@ -1427,7 +1427,7 @@ dns_name_totext2(const dns_name_t *name, unsigned int options,
 					    0) {
 						goto no_escape;
 					}
-				/* FALLTHROUGH */
+					FALLTHROUGH;
 				case 0x22: /* '"' */
 				case 0x28: /* '(' */
 				case 0x29: /* ')' */
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index e2af9a4ea2..8757fbd5ab 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -791,7 +791,7 @@ update_cachestats(dns_rbtdb_t *rbtdb, isc_result_t result) {
 	case DNS_R_COVERINGNSEC:
 		isc_stats_increment(rbtdb->cachestats,
 				    dns_cachestatscounter_coveringnsec);
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case ISC_R_SUCCESS:
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
diff --git a/lib/dns/rdata/generic/opt_41.c b/lib/dns/rdata/generic/opt_41.c
index 6e82d3abdd..d90cc842a0 100644
--- a/lib/dns/rdata/generic/opt_41.c
+++ b/lib/dns/rdata/generic/opt_41.c
@@ -233,7 +233,7 @@ fromwire_opt(ARGS_FROMWIRE) {
 			isc_region_consume(&sregion, length);
 			break;
 		case DNS_OPT_CLIENT_TAG:
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case DNS_OPT_SERVER_TAG:
 			if (length != 2) {
 				return (DNS_R_OPTERR);
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 1816723749..5865b8a4d6 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -7697,7 +7697,7 @@ resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
 		if (query->rmessage->counts[DNS_SECTION_QUESTION] == 0) {
 			break;
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case dns_rcode_nxrrset: /* Not expected. */
 	case dns_rcode_badcookie:
 	case dns_rcode_noerror:
diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
index 15aa14326b..856b718c7c 100644
--- a/lib/dns/rootns.c
+++ b/lib/dns/rootns.c
@@ -130,7 +130,7 @@ check_node(dns_rdataset_t *rootns, dns_name_t *name,
 			if (dns_name_compare(name, dns_rootname) == 0) {
 				break;
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 			result = ISC_R_FAILURE;
 			goto cleanup;
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 5905c8c1c1..0f316308dd 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -2715,7 +2715,7 @@ dns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 				found_zbits = nm_data->set.ns;
 			}
 		}
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 
 	case DNS_R_PARTIALMATCH:
 		i = chain.level_matches;
diff --git a/lib/dns/update.c b/lib/dns/update.c
index f9b80a7da1..610643b807 100644
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -1711,7 +1711,7 @@ next_state:
 
 		update_log(log, zone, ISC_LOG_DEBUG(3),
 			   "updated data signatures");
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case remove_orphaned:
 		state->state = remove_orphaned;
 
@@ -1743,7 +1743,7 @@ next_state:
 		update_log(log, zone, ISC_LOG_DEBUG(3),
 			   "rebuilding NSEC chain");
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case build_chain:
 		state->state = build_chain;
 		/*
@@ -1833,7 +1833,7 @@ next_state:
 
 		CHECK(uniqify_name_list(&state->affected));
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case process_nsec:
 		state->state = process_nsec;
 
@@ -1949,7 +1949,7 @@ next_state:
 		update_log(log, zone, ISC_LOG_DEBUG(3),
 			   "signing rebuilt NSEC chain");
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case sign_nsec:
 		state->state = sign_nsec;
 		/* Update RRSIG NSECs. */
@@ -1981,7 +1981,7 @@ next_state:
 		}
 		ISC_LIST_APPENDLIST(state->nsec_mindiff.tuples,
 				    state->work.tuples, link);
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case update_nsec3:
 		state->state = update_nsec3;
 
@@ -2073,7 +2073,7 @@ next_state:
 			}
 		}
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case process_nsec3:
 		state->state = process_nsec3;
 		while ((t = ISC_LIST_HEAD(state->affected.tuples)) != NULL) {
@@ -2124,7 +2124,7 @@ next_state:
 		update_log(log, zone, ISC_LOG_DEBUG(3),
 			   "signing rebuilt NSEC3 chain");
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case sign_nsec3:
 		state->state = sign_nsec3;
 		/* Update RRSIG NSEC3s. */
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 8ee86a1669..5014e500fb 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -529,7 +529,7 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
 			goto unexpected;
 		}
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case ISC_R_SUCCESS:
 		if (trustchain) {
 			/*
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index ccfa1e8b78..2136cb7fc5 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -680,8 +680,7 @@ redo:
 	case XFRST_AXFR_END:
 	case XFRST_IXFR_END:
 		FAIL(DNS_R_EXTRADATA);
-	/* NOTREACHED */
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	default:
 		INSIST(0);
 		ISC_UNREACHABLE();
@@ -1574,7 +1573,7 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 		break;
 	case XFRST_AXFR_END:
 		CHECK(axfr_finalize(xfr));
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case XFRST_IXFR_END:
 		/*
 		 * Close the journal.
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 3cf0320970..58f1733470 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -11307,7 +11307,7 @@ zone_maintenance(dns_zone_t *zone) {
 		if (zone->primaries == NULL) {
 			break;
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case dns_zone_secondary:
 	case dns_zone_mirror:
 	case dns_zone_stub:
@@ -11332,7 +11332,7 @@ zone_maintenance(dns_zone_t *zone) {
 		if (zone->primaries == NULL) {
 			break;
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case dns_zone_secondary:
 	case dns_zone_mirror:
 	case dns_zone_stub:
@@ -11704,7 +11704,7 @@ zone_journal_rollforward(dns_zone_t *zone, dns_db_t *db, bool *needdump,
 	switch (result) {
 	case ISC_R_SUCCESS:
 		*needdump = true;
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case DNS_R_UPTODATE:
 		if (dns_journal_recovered(journal)) {
 			*fixjournal = true;
@@ -13639,7 +13639,7 @@ stub_callback(isc_task_t *task, isc_event_t *event) {
 				     primary, source);
 			goto same_primary;
 		}
-		/* fallthrough */
+		FALLTHROUGH;
 	default:
 		dns_zonemgr_unreachableadd(zone->zmgr, &zone->primaryaddr,
 					   &zone->sourceaddr, &now);
@@ -14049,7 +14049,7 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 			}
 			goto next_primary;
 		}
-		/* fallthrough */
+		FALLTHROUGH;
 	default:
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refresh: failure trying primary "
@@ -15147,8 +15147,7 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 		if (zone->primaries != NULL) {
 			goto treat_as_secondary;
 		}
-		/* FALLTHROUGH */
-
+		FALLTHROUGH;
 	case dns_zone_primary:
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY) ||
 		    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDSTARTUPNOTIFY))
@@ -15211,8 +15210,7 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 		{
 			next = zone->notifytime;
 		}
-		/* FALLTHROUGH */
-
+		FALLTHROUGH;
 	case dns_zone_stub:
 		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESH) &&
 		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOPRIMARIES) &&
@@ -17577,7 +17575,7 @@ again:
 	switch (xfrresult) {
 	case ISC_R_SUCCESS:
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case DNS_R_UPTODATE:
 		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_FORCEXFER);
 		/*
@@ -17735,7 +17733,6 @@ again:
 			zone->curprimary++;
 		} while (zone->curprimary < zone->primariescnt &&
 			 zone->primariesok[zone->curprimary]);
-		/* FALLTHROUGH */
 	same_primary:
 		if (zone->curprimary >= zone->primariescnt) {
 			zone->curprimary = 0;
diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
index 71bc3b2214..d0cd0197d3 100644
--- a/lib/isc/include/isc/util.h
+++ b/lib/isc/include/isc/util.h
@@ -27,6 +27,18 @@
  * ISC_ or isc_ to the name.
  */
 
+/***
+ *** Clang Compatibility Macros
+ ***/
+
+#if !defined(__has_attribute)
+#define __has_attribute(x) 0
+#endif /* if !defined(__has_attribute) */
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif /* if !defined(__has_feature) */
+
 /***
  *** General Macros.
  ***/
@@ -49,6 +61,14 @@
 #define ISC_NONSTRING
 #endif /* __GNUC__ */
 
+#if __GNUC__ >= 7 || __has_attribute(fallthrough)
+#define FALLTHROUGH __attribute__((fallthrough))
+#else
+/* clang-format off */
+#define FALLTHROUGH do {} while (0) /* FALLTHROUGH */
+/* clang-format on */
+#endif
+
 #if HAVE_FUNC_ATTRIBUTE_CONSTRUCTOR && HAVE_FUNC_ATTRIBUTE_DESTRUCTOR
 #define ISC_CONSTRUCTOR __attribute__((constructor))
 #define ISC_DESTRUCTOR	__attribute__((destructor))
@@ -204,10 +224,6 @@
 #define ISC_UNREACHABLE()
 #endif /* ifdef HAVE_BUILTIN_UNREACHABLE */
 
-#if !defined(__has_feature)
-#define __has_feature(x) 0
-#endif /* if !defined(__has_feature) */
-
 /* GCC defines __SANITIZE_ADDRESS__, so reuse the macro for clang */
 #if __has_feature(address_sanitizer)
 #define __SANITIZE_ADDRESS__ 1
diff --git a/lib/isc/lex.c b/lib/isc/lex.c
index 6373a98393..9f2a9254c5 100644
--- a/lib/isc/lex.c
+++ b/lib/isc/lex.c
@@ -688,7 +688,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 				state = lexstate_vpairstart;
 				break;
 			}
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 		case lexstate_vpairstart:
 			if (state == lexstate_vpairstart) {
 				if (c == '"' &&
@@ -699,7 +699,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 				}
 				state = lexstate_vpair;
 			}
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 		case lexstate_vpair:
 			/*
 			 * EOF needs to be checked before lex->specials[c]
diff --git a/lib/isc/log.c b/lib/isc/log.c
index 6fd80c207a..f41c39237d 100644
--- a/lib/isc/log.c
+++ b/lib/isc/log.c
@@ -1798,7 +1798,7 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 				}
 				channel->flags &= ~ISC_LOG_OPENERR;
 			}
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 
 		case ISC_LOG_TOFILEDESC:
 			fprintf(FILE_STREAM(channel), "%s%s%s%s%s%s%s%s%s%s\n",
diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
index fdc1e6fe4c..4216b5c24b 100644
--- a/lib/isc/netmgr/netmgr.c
+++ b/lib/isc/netmgr/netmgr.c
@@ -1620,7 +1620,7 @@ isc___nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t *peer,
 		if (!atomic_load(&sock->client)) {
 			break;
 		}
-		/* fallthrough */
+		FALLTHROUGH;
 	case isc_nm_tcpsocket:
 	case isc_nm_tlssocket:
 		INSIST(sock->statichandle == NULL);
@@ -2898,7 +2898,7 @@ shutdown_walk_cb(uv_handle_t *handle, void *arg) {
 				isc__nmsocket_reset(sock);
 				return;
 			}
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 			isc__nmsocket_shutdown(sock);
 		}
diff --git a/lib/isc/ratelimiter.c b/lib/isc/ratelimiter.c
index 327144eb82..ceab020503 100644
--- a/lib/isc/ratelimiter.c
+++ b/lib/isc/ratelimiter.c
@@ -311,7 +311,7 @@ isc_ratelimiter_stall(isc_ratelimiter_t *rl) {
 		result = isc_timer_reset(rl->timer, isc_timertype_inactive,
 					 NULL, false);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case isc_ratelimiter_idle:
 	case isc_ratelimiter_stalled:
 		rl->state = isc_ratelimiter_stalled;
diff --git a/lib/isc/siphash.c b/lib/isc/siphash.c
index 8cd4691289..0f83ef5f2e 100644
--- a/lib/isc/siphash.c
+++ b/lib/isc/siphash.c
@@ -120,25 +120,25 @@ isc_siphash24(const uint8_t *k, const uint8_t *in, const size_t inlen,
 	switch (left) {
 	case 7:
 		b |= ((uint64_t)in[6]) << 48;
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 6:
 		b |= ((uint64_t)in[5]) << 40;
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 5:
 		b |= ((uint64_t)in[4]) << 32;
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 4:
 		b |= ((uint64_t)in[3]) << 24;
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 3:
 		b |= ((uint64_t)in[2]) << 16;
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 2:
 		b |= ((uint64_t)in[1]) << 8;
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 1:
 		b |= ((uint64_t)in[0]);
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 0:
 		break;
 	default:
@@ -198,13 +198,13 @@ isc_halfsiphash24(const uint8_t *k, const uint8_t *in, const size_t inlen,
 	switch (left) {
 	case 3:
 		b |= ((uint32_t)in[2]) << 16;
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 2:
 		b |= ((uint32_t)in[1]) << 8;
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 1:
 		b |= ((uint32_t)in[0]);
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case 0:
 		break;
 	default:
diff --git a/lib/isc/tm.c b/lib/isc/tm.c
index dbdfc31ee7..19a7bee453 100644
--- a/lib/isc/tm.c
+++ b/lib/isc/tm.c
@@ -322,7 +322,7 @@ isc_tm_strptime(const char *buf, const char *fmt, struct tm *tm) {
 
 		case 'k': /* The hour (24-hour clock representation). */
 			LEGAL_ALT(0);
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'H':
 			LEGAL_ALT(ALT_O);
 			if (!(conv_num(&bp, &tm->tm_hour, 0, 23))) {
@@ -332,7 +332,7 @@ isc_tm_strptime(const char *buf, const char *fmt, struct tm *tm) {
 
 		case 'l': /* The hour (12-hour clock representation). */
 			LEGAL_ALT(0);
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'I':
 			LEGAL_ALT(ALT_O);
 			if (!(conv_num(&bp, &tm->tm_hour, 1, 12))) {
diff --git a/lib/isc/url.c b/lib/isc/url.c
index 100b91c177..8758496e5b 100644
--- a/lib/isc/url.c
+++ b/lib/isc/url.c
@@ -277,7 +277,7 @@ parse_url_char(state_t s, const char ch) {
 			return (s_dead);
 		}
 
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case s_req_server_start:
 	case s_req_server:
 		if (ch == '/') {
@@ -399,7 +399,7 @@ http_parse_host_char(host_state_t s, const char ch) {
 			return (s_http_host);
 		}
 
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case s_http_host_v6_end:
 		if (ch == ':') {
 			return (s_http_host_port_start);
@@ -412,7 +412,7 @@ http_parse_host_char(host_state_t s, const char ch) {
 			return (s_http_host_v6_end);
 		}
 
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case s_http_host_v6_start:
 		if (isxdigit((unsigned char)ch) || ch == ':' || ch == '.') {
 			return (s_http_host_v6);
@@ -428,7 +428,7 @@ http_parse_host_char(host_state_t s, const char ch) {
 			return (s_http_host_v6_end);
 		}
 
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case s_http_host_v6_zone_start:
 		/* RFC 6874 Zone ID consists of 1*( unreserved / pct-encoded) */
 		if (isalnum((unsigned char)ch) || ch == '%' || ch == '.' ||
@@ -578,7 +578,7 @@ isc_url_parse(const char *buf, size_t buflen, bool is_connect,
 
 		case s_req_server_with_at:
 			found_at = 1;
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 		case s_req_server:
 			uf = ISC_UF_HOST;
 			break;
diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index ea030fbd9d..d03dc40fe3 100644
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -426,8 +426,8 @@ geoip_can_answer(dns_aclelement_t *elt, cfg_aclconfctx_t *ctx) {
 		if (ctx->geoip->country != NULL) {
 			return (true);
 		}
-	/* city db can answer these too, so: */
-	/* FALLTHROUGH */
+		/* city db can answer these too, so: */
+		FALLTHROUGH;
 	case dns_geoip_region:
 	case dns_geoip_regionname:
 	case dns_geoip_city_countrycode:
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 4ef38965ed..9a661c6d0a 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2566,7 +2566,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 			break;
 		case ISC_R_SOFTQUOTA:
 			isc_quota_detach(&client->recursionquota);
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 			return;
 		}
@@ -2784,7 +2784,7 @@ query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
 			break;
 		case ISC_R_SOFTQUOTA:
 			isc_quota_detach(&client->recursionquota);
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 			return;
 		}
@@ -7247,7 +7247,7 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
 			break;
 		case DNS_RPZ_POLICY_NODATA:
 			qctx->nxrewrite = true;
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case DNS_RPZ_POLICY_DNS64:
 			result = DNS_R_NXRRSET;
 			qctx->rpz = true;
@@ -10159,7 +10159,7 @@ query_coveringnsec(query_ctx_t *qctx) {
 		{
 			goto cleanup;
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case DNS_R_CNAME:
 		if (!qctx->resuming && !STALE(&rdataset) && rdataset.ttl == 0 &&
 		    RECURSIONOK(qctx->client))