diff --git a/CHANGES b/CHANGES
index 2b1e5735b4..3490b12220 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4461.	[bug]		win32: not all external data was properly marked
+			as external data for windows dll. [RT #43161]
+
 4458.	[cleanup]	Update assertions to be more correct, and also remove
 			use of a reserved word. [RT #43090]
 
diff --git a/bin/named/main.c b/bin/named/main.c
index e97bf23881..92548a7cf0 100644
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -105,10 +105,10 @@
 #define BACKTRACE_MAXFRAME 128
 #endif
 
-extern int isc_dscp_check_value;
-extern unsigned int dns_zone_mkey_hour;
-extern unsigned int dns_zone_mkey_day;
-extern unsigned int dns_zone_mkey_month;
+LIBISC_EXTERNAL_DATA extern int isc_dscp_check_value;
+LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_hour;
+LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_day;
+LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;
 
 static isc_boolean_t	want_stats = ISC_FALSE;
 static char		program_name[ISC_DIR_NAMEMAX] = "named";
diff --git a/lib/dns/iptable.c b/lib/dns/iptable.c
index 701950533c..ee08c97ac5 100644
--- a/lib/dns/iptable.c
+++ b/lib/dns/iptable.c
@@ -54,8 +54,8 @@ dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target) {
 	return (result);
 }
 
-isc_boolean_t dns_iptable_neg = ISC_FALSE;
-isc_boolean_t dns_iptable_pos = ISC_TRUE;
+static isc_boolean_t dns_iptable_neg = ISC_FALSE;
+static isc_boolean_t dns_iptable_pos = ISC_TRUE;
 
 /*
  * Add an IP prefix to an existing IP table
diff --git a/lib/dns/opensslgost_link.c b/lib/dns/opensslgost_link.c
index 7167a74210..04e0583ac6 100644
--- a/lib/dns/opensslgost_link.c
+++ b/lib/dns/opensslgost_link.c
@@ -281,7 +281,7 @@ opensslgost_destroy(dst_key_t *key) {
 	key->keydata.pkey = NULL;
 }
 
-unsigned char gost_prefix[37] = {
+static const unsigned char gost_prefix[37] = {
 	0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85,
 	0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07,
 	0x2a, 0x85, 0x03, 0x02, 0x02, 0x23, 0x01, 0x06,
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 9ae540c418..615beffd1f 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -91,7 +91,7 @@ static dns_name_t hmacmd5 = {
 	{NULL, NULL}
 };
 
-dns_name_t *dns_tsig_hmacmd5_name = &hmacmd5;
+LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacmd5_name = &hmacmd5;
 #endif
 
 static unsigned char gsstsig_ndata[] = "\010gss-tsig";
diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
index 862bdb31f1..89c78362c9 100644
--- a/lib/dns/win32/libdns.def.in
+++ b/lib/dns/win32/libdns.def.in
@@ -1110,9 +1110,6 @@ dns_zone_log
 dns_zone_logc
 dns_zone_maintenance
 dns_zone_markdirty
-dns_zone_mkey_hour
-dns_zone_mkey_day
-dns_zone_mkey_month
 dns_zone_name
 dns_zone_nameonly
 dns_zone_next
@@ -1326,5 +1323,13 @@ dst_result_totext
 
 EXPORTS
 
+dns_pps			DATA
 dns_master_style_full	DATA
-@END NOLONGER
+dns_msgcat		DATA
+dns_tsig_hmacmd5_name	DATA
+dns_zone_mkey_day	DATA
+dns_zone_mkey_hour	DATA
+dns_zone_mkey_month	DATA
+dst__memory_pool	DATA
+dst_msgcat		DATA
+@IF NOLONGER
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 0651063d8e..e5b496ee5b 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -700,18 +700,17 @@ struct dns_include {
 	ISC_LINK(dns_include_t)	link;
 };
 
-#define HOUR 3600
-#define DAY (24*HOUR)
-#define MONTH (30*DAY)
-
 /*
  * These can be overridden by the -T mkeytimers option on the command
  * line, so that we can test with shorter periods than specified in
  * RFC 5011.
  */
-unsigned int dns_zone_mkey_hour = HOUR;
-unsigned int dns_zone_mkey_day = DAY;
-unsigned int dns_zone_mkey_month = MONTH;
+#define HOUR 3600
+#define DAY (24*HOUR)
+#define MONTH (30*DAY)
+LIBDNS_EXTERNAL_DATA unsigned int dns_zone_mkey_hour = HOUR;
+LIBDNS_EXTERNAL_DATA unsigned int dns_zone_mkey_day = DAY;
+LIBDNS_EXTERNAL_DATA unsigned int dns_zone_mkey_month = MONTH;
 
 #define SEND_BUFFER_SIZE 2048
 
diff --git a/lib/isc/backtrace-emptytbl.c b/lib/isc/backtrace-emptytbl.c
index bd534d60c8..d1bcb77eff 100644
--- a/lib/isc/backtrace-emptytbl.c
+++ b/lib/isc/backtrace-emptytbl.c
@@ -30,5 +30,6 @@
 
 #include <isc/backtrace.h>
 
-const int isc__backtrace_nsymbols = 0;
-const isc_backtrace_symmap_t isc__backtrace_symtable[] = { { NULL, "" } };
+LIBISC_EXTERNAL_DATA const int isc__backtrace_nsymbols = 0;
+LIBISC_EXTERNAL_DATA const
+	isc_backtrace_symmap_t isc__backtrace_symtable[] = { { NULL, "" } };
diff --git a/lib/isc/include/isc/backtrace.h b/lib/isc/include/isc/backtrace.h
index c0e98c0b75..f3c66a2636 100644
--- a/lib/isc/include/isc/backtrace.h
+++ b/lib/isc/include/isc/backtrace.h
@@ -54,8 +54,9 @@ struct isc_backtrace_symmap {
 	const char	*symbol;
 };
 
-extern const int isc__backtrace_nsymbols;
-extern const isc_backtrace_symmap_t isc__backtrace_symtable[];
+LIBISC_EXTERNAL_DATA extern const int isc__backtrace_nsymbols;
+LIBISC_EXTERNAL_DATA extern const
+	isc_backtrace_symmap_t isc__backtrace_symtable[];
 
 /***
  *** Functions
diff --git a/lib/isc/win32/libisc.def.in b/lib/isc/win32/libisc.def.in
index 747c73e78d..ce8567a357 100644
--- a/lib/isc/win32/libisc.def.in
+++ b/lib/isc/win32/libisc.def.in
@@ -28,8 +28,6 @@ isc__appctx_destroy
 isc__appctx_setsocketmgr
 isc__appctx_settaskmgr
 isc__appctx_settimermgr
-isc__backtrace_nsymbols
-isc__backtrace_symtable
 isc__buffer_activeregion
 isc__buffer_add
 isc__buffer_availableregion
@@ -189,7 +187,6 @@ isc_dir_init
 isc_dir_open
 isc_dir_read
 isc_dir_reset
-isc_dscp_check_value
 isc_entropy_addcallbacksample
 isc_entropy_addsample
 isc_entropy_attach
@@ -767,6 +764,8 @@ syslog
 
 EXPORTS
 
+isc__backtrace_nsymbols		DATA
+isc__backtrace_symtable		DATA
 isc_bind9			DATA
 isc_commandline_argument	DATA
 isc_commandline_errprint	DATA
@@ -774,8 +773,11 @@ isc_commandline_index		DATA
 isc_commandline_option		DATA
 isc_commandline_progname	DATA
 isc_commandline_reset		DATA
+isc_dscp_check_value		DATA
 isc_mem_debugging		DATA
+isc_msgcat			DATA
 @IF PKCS11
+pk11_msgcat			DATA
 pk11_verbose_init		DATA
 @END PKCS11
 @END NOLONGER
diff --git a/lib/isc/win32/socket.c b/lib/isc/win32/socket.c
index 62dced3fd3..3058d14107 100644
--- a/lib/isc/win32/socket.c
+++ b/lib/isc/win32/socket.c
@@ -83,7 +83,7 @@
  * other than -1, we check to make sure DSCP values match it, and
  * assert if not.
  */
-int isc_dscp_check_value = -1;
+LIBISC_EXTERNAL_DATA int isc_dscp_check_value = -1;
 
 /*
  * How in the world can Microsoft exist with APIs like this?
diff --git a/lib/isccc/win32/libisccc.def b/lib/isccc/win32/libisccc.def
index 5d32a52830..7a06b9a447 100644
--- a/lib/isccc/win32/libisccc.def
+++ b/lib/isccc/win32/libisccc.def
@@ -64,3 +64,7 @@ isccc_symtab_lookup
 isccc_symtab_define
 isccc_symtab_undefine
 isccc_symtab_foreach
+
+; Exported Data
+
+;isccc_msgcat
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index 3b864a425b..623e22829a 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -112,17 +112,17 @@ parser_complain(cfg_parser_t *pctx, isc_boolean_t is_warning,
  * not need a union member).
  */
 
-cfg_rep_t cfg_rep_uint32 = { "uint32", free_noop };
-cfg_rep_t cfg_rep_uint64 = { "uint64", free_noop };
-cfg_rep_t cfg_rep_string = { "string", free_string };
-cfg_rep_t cfg_rep_boolean = { "boolean", free_noop };
-cfg_rep_t cfg_rep_map = { "map", free_map };
-cfg_rep_t cfg_rep_list = { "list", free_list };
-cfg_rep_t cfg_rep_tuple = { "tuple", free_tuple };
-cfg_rep_t cfg_rep_sockaddr = { "sockaddr", free_noop };
-cfg_rep_t cfg_rep_netprefix = { "netprefix", free_noop };
-cfg_rep_t cfg_rep_void = { "void", free_noop };
-cfg_rep_t cfg_rep_fixedpoint = { "fixedpoint", free_noop };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_uint32 = { "uint32", free_noop };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_uint64 = { "uint64", free_noop };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_string = { "string", free_string };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_boolean = { "boolean", free_noop };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_map = { "map", free_map };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_list = { "list", free_list };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_tuple = { "tuple", free_tuple };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_sockaddr = { "sockaddr", free_noop };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_netprefix = { "netprefix", free_noop };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_void = { "void", free_noop };
+LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_fixedpoint = { "fixedpoint", free_noop };
 
 /*
  * Configuration type definitions.
@@ -599,7 +599,7 @@ cfg_obj_isvoid(const cfg_obj_t *obj) {
 	return (ISC_TF(obj->type->rep == &cfg_rep_void));
 }
 
-cfg_type_t cfg_type_void = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_void = {
 	"void", cfg_parse_void, cfg_print_void, cfg_doc_void, &cfg_rep_void,
 	NULL };
 
@@ -672,7 +672,7 @@ cfg_obj_asfixedpoint(const cfg_obj_t *obj) {
 	return (obj->value.uint32);
 }
 
-cfg_type_t cfg_type_fixedpoint = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_fixedpoint = {
 	"fixedpoint", cfg_parse_fixedpoint, cfg_print_fixedpoint,
 	cfg_doc_terminal, &cfg_rep_fixedpoint, NULL
 };
@@ -729,7 +729,7 @@ cfg_obj_asuint32(const cfg_obj_t *obj) {
 	return (obj->value.uint32);
 }
 
-cfg_type_t cfg_type_uint32 = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_uint32 = {
 	"integer", cfg_parse_uint32, cfg_print_uint32, cfg_doc_terminal,
 	&cfg_rep_uint32, NULL
 };
@@ -758,7 +758,7 @@ cfg_print_uint64(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	cfg_print_cstr(pctx, buf);
 }
 
-cfg_type_t cfg_type_uint64 = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_uint64 = {
 	"64_bit_integer", NULL, cfg_print_uint64, cfg_doc_terminal,
 	&cfg_rep_uint64, NULL
 };
@@ -948,19 +948,19 @@ cfg_obj_asstring(const cfg_obj_t *obj) {
 }
 
 /* Quoted string only */
-cfg_type_t cfg_type_qstring = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_qstring = {
 	"quoted_string", cfg_parse_qstring, print_qstring, cfg_doc_terminal,
 	&cfg_rep_string, NULL
 };
 
 /* Unquoted string only */
-cfg_type_t cfg_type_ustring = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_ustring = {
 	"string", parse_ustring, cfg_print_ustring, cfg_doc_terminal,
 	&cfg_rep_string, NULL
 };
 
 /* Any string (quoted or unquoted); printed with quotes */
-cfg_type_t cfg_type_astring = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_astring = {
 	"string", cfg_parse_astring, print_qstring, cfg_doc_terminal,
 	&cfg_rep_string, NULL
 };
@@ -969,7 +969,7 @@ cfg_type_t cfg_type_astring = {
  * Any string (quoted or unquoted); printed with quotes.
  * If CFG_PRINTER_XKEY is set when printing the string will be '?' out.
  */
-cfg_type_t cfg_type_sstring = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_sstring = {
 	"string", cfg_parse_sstring, print_sstring, cfg_doc_terminal,
 	&cfg_rep_string, NULL
 };
@@ -1038,7 +1038,7 @@ cfg_print_boolean(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 		cfg_print_chars(pctx, "no", 2);
 }
 
-cfg_type_t cfg_type_boolean = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_boolean = {
 	"boolean", cfg_parse_boolean, cfg_print_boolean, cfg_doc_terminal,
 	&cfg_rep_boolean, NULL
 };
@@ -1771,7 +1771,7 @@ parse_token(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (result);
 }
 
-cfg_type_t cfg_type_token = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_token = {
 	"token", parse_token, cfg_print_ustring, cfg_doc_terminal,
 	&cfg_rep_string, NULL
 };
@@ -1820,7 +1820,7 @@ parse_unsupported(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (result);
 }
 
-cfg_type_t cfg_type_unsupported = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_unsupported = {
 	"unsupported", parse_unsupported, cfg_print_spacelist, cfg_doc_terminal,
 	&cfg_rep_list, NULL
 };
@@ -2063,27 +2063,27 @@ cfg_doc_netaddr(cfg_printer_t *pctx, const cfg_type_t *type) {
 		cfg_print_chars(pctx, " )", 2);
 }
 
-cfg_type_t cfg_type_netaddr = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr = {
 	"netaddr", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
 	&cfg_rep_sockaddr, &netaddr_flags
 };
 
-cfg_type_t cfg_type_netaddr4 = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr4 = {
 	"netaddr4", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
 	&cfg_rep_sockaddr, &netaddr4_flags
 };
 
-cfg_type_t cfg_type_netaddr4wild = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr4wild = {
 	"netaddr4wild", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
 	&cfg_rep_sockaddr, &netaddr4wild_flags
 };
 
-cfg_type_t cfg_type_netaddr6 = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr6 = {
 	"netaddr6", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
 	&cfg_rep_sockaddr, &netaddr6_flags
 };
 
-cfg_type_t cfg_type_netaddr6wild = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr6wild = {
 	"netaddr6wild", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
 	&cfg_rep_sockaddr, &netaddr6wild_flags
 };
@@ -2169,7 +2169,7 @@ cfg_obj_asnetprefix(const cfg_obj_t *obj, isc_netaddr_t *netaddr,
 	*prefixlen = obj->value.netprefix.prefixlen;
 }
 
-cfg_type_t cfg_type_netprefix = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netprefix = {
 	"netprefix", cfg_parse_netprefix, print_netprefix, cfg_doc_terminal,
 	&cfg_rep_netprefix, NULL
 };
@@ -2227,14 +2227,14 @@ parse_sockaddrsub(cfg_parser_t *pctx, const cfg_type_t *type,
 }
 
 static unsigned int sockaddr_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK;
-cfg_type_t cfg_type_sockaddr = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_sockaddr = {
 	"sockaddr", cfg_parse_sockaddr, cfg_print_sockaddr, cfg_doc_sockaddr,
 	&cfg_rep_sockaddr, &sockaddr_flags
 };
 
 static unsigned int sockaddrdscp_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK |
 					 CFG_ADDR_DSCPOK;
-cfg_type_t cfg_type_sockaddrdscp = {
+LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_sockaddrdscp = {
 	"sockaddr", cfg_parse_sockaddr, cfg_print_sockaddr, cfg_doc_sockaddr,
 	&cfg_rep_sockaddr, &sockaddrdscp_flags
 };
diff --git a/lib/isccfg/win32/libisccfg.def b/lib/isccfg/win32/libisccfg.def
index a1d95125c2..431e305d23 100644
--- a/lib/isccfg/win32/libisccfg.def
+++ b/lib/isccfg/win32/libisccfg.def
@@ -113,4 +113,37 @@ cfg_ungettoken
 
 ; Exported Data
 
+;cfg_rep_boolean
+;cfg_rep_fixedpoint
+;cfg_rep_list
+;cfg_rep_map
+;cfg_rep_netprefix
+;cfg_rep_percentage
+;cfg_rep_sockaddr
+;cfg_rep_string
+;cfg_rep_tuple
+;cfg_rep_uint32
+;cfg_rep_uint64
+;cfg_rep_void
+;cfg_type_astring
+;cfg_type_boolean
+;cfg_type_bracketed_text
+;cfg_type_fixedpoint
+;cfg_type_netaddr
+;cfg_type_netaddr4
+;cfg_type_netaddr4wild
+;cfg_type_netaddr6
+;cfg_type_netaddr6wild
+;cfg_type_netprefix
+;cfg_type_percentage
+;cfg_type_qstring
 ;cfg_type_rndcconf
+;cfg_type_sockaddr
+;cfg_type_sockaddrdscp
+;cfg_type_sstring
+;cfg_type_token
+;cfg_type_uint32
+;cfg_type_uint64
+;cfg_type_unsupported
+;cfg_type_ustring
+;cfg_type_void
diff --git a/lib/tests/t_api.c b/lib/tests/t_api.c
index de646eb5a9..bfc68ee080 100644
--- a/lib/tests/t_api.c
+++ b/lib/tests/t_api.c
@@ -615,7 +615,7 @@ t_getdate(char *buf, size_t buflen) {
 /*
  * Some generally used utilities.
  */
-struct dns_errormap {
+static const struct dns_errormap {
 	isc_result_t	result;
 	const char *text;
 } dns_errormap[] = {
@@ -669,8 +669,8 @@ struct dns_errormap {
 isc_result_t
 t_dns_result_fromtext(char *name) {
 
-	isc_result_t		result;
-	struct dns_errormap	*pmap;
+	isc_result_t			result;
+	const struct dns_errormap	*pmap;
 
 	result = ISC_R_UNEXPECTED;
 
@@ -687,7 +687,7 @@ t_dns_result_fromtext(char *name) {
 	return (result);
 }
 
-struct dc_method_map {
+static const struct dc_method_map {
 	unsigned int	dc_method;
 	const char 	*text;
 } dc_method_map[] = {
@@ -700,8 +700,8 @@ struct dc_method_map {
 
 unsigned int
 t_dc_method_fromtext(char *name) {
-	unsigned int		dc_method;
-	struct dc_method_map	*pmap;
+	unsigned int			dc_method;
+	const struct dc_method_map	*pmap;
 
 	dc_method = DNS_COMPRESS_NONE;