diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index eb4086493c..a08ba81b76 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -277,7 +277,9 @@ stages:
     - *configure
     - *check_readline_setup
     - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - test -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && CFLAGS="${CFLAGS} -Werror" make -C "${DIR}"; done
     - test -z "${RUN_MAKE_INSTALL}" || make DESTDIR="${INSTALL_PATH}" install
+    - test -z "${RUN_MAKE_INSTALL}" -o -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && make -C "${DIR}" DESTDIR="${INSTALL_PATH}" install; done
     - test -z "${RUN_MAKE_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh util/check-make-install
     - if [[ "${CFLAGS}" == *"-fsanitize=address"* ]]; then ( ! grep -F AddressSanitizer config.log ); fi
     - test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
@@ -693,9 +695,11 @@ unit:gcc:buster:amd64:
 
 gcc:bullseye:amd64:
   variables:
+    BUILD_CONTRIB: 1
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
     EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
+    RUN_MAKE_INSTALL: 1
   <<: *debian_bullseye_amd64_image
   <<: *build_job
 
@@ -1097,13 +1101,17 @@ unit:clang:tsan:
       artifacts: true
 
 # Jobs for Clang builds on Debian 11 "bullseye" (amd64)
+# The -Wno-compound-token-split-by-macro option prevents warning when compiling
+# Perl DLZ module with Clang against Perl older than version 5.35.2.
 
 clang:bullseye:amd64:
   variables:
+    BUILD_CONTRIB: 1
     CC: ${CLANG}
-    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
+    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion -Wno-compound-token-split-by-macro"
     # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
     EXTRA_CONFIGURE: "--without-jemalloc"
+    RUN_MAKE_INSTALL: 1
   <<: *debian_bullseye_amd64_image
   <<: *build_job
 
@@ -1495,6 +1503,8 @@ gcov:
     - for SRC in dns isc; do for DST in dns isc ns; do cp -f "lib/${SRC}/include/${SRC}"/*.h "lib/${DST}/"; done; done
     - find bin lib -maxdepth 1 -mindepth 1 -type d -exec cp -f lib/isc/include/isc/buffer.h "{}" \;
     - cp -f lib/isc/include/isc/buffer.h lib/isc/netmgr/buffer.h
+    # Help gcovr find dlz_dbi.c file
+    - for DST in ldap mysql mysqldyn sqlite3 wildcard; do cp contrib/dlz/modules/common/dlz_dbi.c "contrib/dlz/modules/${DST}"; done
     # Generate XML file in the Cobertura XML format suitable for use by GitLab
     # for the purpose of displaying code coverage information in the diff view
     # of a given merge request.
diff --git a/contrib/dlz/example/Makefile b/contrib/dlz/example/Makefile
index c4479403e2..5c66ba1f31 100644
--- a/contrib/dlz/example/Makefile
+++ b/contrib/dlz/example/Makefile
@@ -16,7 +16,7 @@
 # this means this Makefile is not portable, so the testsuite
 # skips this test on platforms where it doesn't build
 
-CFLAGS=-Wall -fPIC -g
+CFLAGS += -Wall -fPIC -g
 
 all: dlz_example.so
 
diff --git a/contrib/dlz/modules/bdbhpt/Makefile b/contrib/dlz/modules/bdbhpt/Makefile
index 45080af743..29d6b94cc6 100644
--- a/contrib/dlz/modules/bdbhpt/Makefile
+++ b/contrib/dlz/modules/bdbhpt/Makefile
@@ -26,7 +26,7 @@
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 BDB_LIBS=-ldb
 
 all: dlz_bdbhpt_dynamic.so
diff --git a/contrib/dlz/modules/filesystem/Makefile b/contrib/dlz/modules/filesystem/Makefile
index 40ecb79c5b..6c5470f343 100644
--- a/contrib/dlz/modules/filesystem/Makefile
+++ b/contrib/dlz/modules/filesystem/Makefile
@@ -26,7 +26,7 @@
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 
 all: dlz_filesystem_dynamic.so
 
diff --git a/contrib/dlz/modules/include/dlz_list.h b/contrib/dlz/modules/include/dlz_list.h
index 202bc0690a..077ae89a73 100644
--- a/contrib/dlz/modules/include/dlz_list.h
+++ b/contrib/dlz/modules/include/dlz_list.h
@@ -54,3 +54,17 @@
 
 #define DLZ_LIST_PREV(elt, link) ((elt)->link.prev)
 #define DLZ_LIST_NEXT(elt, link) ((elt)->link.next)
+
+#define DLZ_LIST_UNLINK(list, elt, link)                                \
+	do {                                                            \
+		if ((elt)->link.next != NULL)                           \
+			(elt)->link.next->link.prev = (elt)->link.prev; \
+		else                                                    \
+			(list).tail = (elt)->link.prev;                 \
+		if ((elt)->link.prev != NULL)                           \
+			(elt)->link.prev->link.next = (elt)->link.next; \
+		else                                                    \
+			(list).head = (elt)->link.next;                 \
+		(elt)->link.prev = (void *)(-1);                        \
+		(elt)->link.next = (void *)(-1);                        \
+	} while (0)
diff --git a/contrib/dlz/modules/ldap/Makefile b/contrib/dlz/modules/ldap/Makefile
index 8e86e3ef97..d9b6ff5bfe 100644
--- a/contrib/dlz/modules/ldap/Makefile
+++ b/contrib/dlz/modules/ldap/Makefile
@@ -26,7 +26,7 @@
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 LDAP_LIBS=-lldap
 
 all: dlz_ldap_dynamic.so
diff --git a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
index 48f4b63262..ce1c50c44a 100644
--- a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
+++ b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
@@ -971,11 +971,13 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
+		FALLTHROUGH;
 	case 11:
 		result = dlz_ldap_checkURL(ldap, argv[10], 3, "all nodes");
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
+		FALLTHROUGH;
 	case 10:
 		if (strlen(argv[9]) > 0) {
 			result = dlz_ldap_checkURL(ldap, argv[9], 3,
@@ -984,6 +986,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 				goto cleanup;
 			}
 		}
+		FALLTHROUGH;
 	case 9:
 		result = dlz_ldap_checkURL(ldap, argv[8], 3, "lookup");
 		if (result != ISC_R_SUCCESS) {
diff --git a/contrib/dlz/modules/mysql/Makefile b/contrib/dlz/modules/mysql/Makefile
index 606dcefe6c..5d0904c13f 100644
--- a/contrib/dlz/modules/mysql/Makefile
+++ b/contrib/dlz/modules/mysql/Makefile
@@ -26,7 +26,7 @@
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include $(shell mysql_config --cflags)
+CFLAGS += -fPIC -g -I../include $(shell mysql_config --cflags)
 MYSQL_LIBS=$(shell mysql_config --libs)
 
 all: dlz_mysql_dynamic.so
diff --git a/contrib/dlz/modules/mysqldyn/Makefile b/contrib/dlz/modules/mysqldyn/Makefile
index 38fe4ff9b1..f78cd2ff2e 100644
--- a/contrib/dlz/modules/mysqldyn/Makefile
+++ b/contrib/dlz/modules/mysqldyn/Makefile
@@ -26,7 +26,7 @@
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include $(shell mysql_config --cflags)
+CFLAGS += -fPIC -g -I../include $(shell mysql_config --cflags)
 MYSQL_LIBS=$(shell mysql_config --libs)
 
 all: dlz_mysqldyn_mod.so
diff --git a/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c b/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
index 9af5a7e692..bdd0bccdc6 100644
--- a/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
+++ b/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
@@ -461,9 +461,8 @@ build_query(mysql_data_t *state, mysql_instance_t *dbi, const char *command,
 fail:
 	va_end(ap1);
 
-	for (item = DLZ_LIST_HEAD(arglist); item != NULL;
-	     item = DLZ_LIST_NEXT(item, link))
-	{
+	while ((item = DLZ_LIST_HEAD(arglist)) != NULL) {
+		DLZ_LIST_UNLINK(arglist, item, link);
 		if (item->arg != NULL) {
 			free(item->arg);
 		}
@@ -1078,6 +1077,8 @@ dlz_destroy(void *dbdata) {
 isc_result_t
 dlz_findzonedb(void *dbdata, const char *name, dns_clientinfomethods_t *methods,
 	       dns_clientinfo_t *clientinfo) {
+	UNUSED(methods);
+	UNUSED(clientinfo);
 	isc_result_t result = ISC_R_SUCCESS;
 	mysql_data_t *state = (mysql_data_t *)dbdata;
 	MYSQL_RES *res;
@@ -1110,6 +1111,8 @@ isc_result_t
 dlz_lookup(const char *zone, const char *name, void *dbdata,
 	   dns_sdlzlookup_t *lookup, dns_clientinfomethods_t *methods,
 	   dns_clientinfo_t *clientinfo) {
+	UNUSED(methods);
+	UNUSED(clientinfo);
 	isc_result_t result;
 	mysql_data_t *state = (mysql_data_t *)dbdata;
 	bool found = false;
diff --git a/contrib/dlz/modules/perl/Makefile b/contrib/dlz/modules/perl/Makefile
index f423d17bcd..ec99e0008d 100644
--- a/contrib/dlz/modules/perl/Makefile
+++ b/contrib/dlz/modules/perl/Makefile
@@ -57,3 +57,7 @@ $(LIBNAME): dlz_perl_driver.o dlz_perl_callback_clientinfo.o dlz_perl_callback.o
 
 clean:
 	rm -f dlz_perl_driver.o dlz_perl_driver.so dlz_perl_callback_clientinfo.c dlz_perl_callback_clientinfo.o dlz_perl_callback.c dlz_perl_callback.o
+
+install: dlz_perl_driver.so
+	mkdir -p $(DESTDIR)$(libdir)
+	install dlz_perl_driver.so $(DESTDIR)$(libdir)
diff --git a/contrib/dlz/modules/perl/dlz_perl_driver.c b/contrib/dlz/modules/perl/dlz_perl_driver.c
index 9bbcfc2b0b..88edc0ced0 100644
--- a/contrib/dlz/modules/perl/dlz_perl_driver.c
+++ b/contrib/dlz/modules/perl/dlz_perl_driver.c
@@ -37,6 +37,8 @@
 
 #include <dlz_minimal.h>
 
+#define BUF_LEN 64 /* Should be big enough, right? hah */
+
 /* Enable debug logging? */
 #if 0
 #define carp(...) cd->log(ISC_LOG_INFO, __VA_ARGS__);
@@ -79,7 +81,7 @@ EXTERN_C void
 boot_DLZ_Perl(pTHX_ CV *cv);
 EXTERN_C void
 xs_init(pTHX) {
-	char *file = __FILE__;
+	const char *file = __FILE__;
 	dXSUB_SYS;
 
 	/* DynaLoader is a special case */
@@ -114,6 +116,7 @@ b9_add_helper(config_data_t *state, const char *helper_name, void *ptr) {
 
 int
 dlz_version(unsigned int *flags) {
+	UNUSED(flags);
 	return (DLZ_DLOPEN_VERSION);
 }
 
@@ -148,7 +151,7 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 	SPAGAIN;
 
 	if (SvTRUE(ERRSV)) {
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR,
 			"DLZ Perl: allnodes for zone %s died in eval: %s", zone,
 			SvPV_nolen(ERRSV));
@@ -248,7 +251,7 @@ dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
 		 * it away so we don't leave junk on the stack for the next
 		 * caller.
 		 */
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR,
 			"DLZ Perl: allowzonexfr died in eval: %s",
 			SvPV_nolen(ERRSV));
@@ -325,7 +328,7 @@ dlz_findzonedb(void *dbdata, const char *name, dns_clientinfomethods_t *methods,
 		 * it away so we don't leave junk on the stack for the next
 		 * caller.
 		 */
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR, "DLZ Perl: findzone died in eval: %s",
 			SvPV_nolen(ERRSV));
 		retval = ISC_R_FAILURE;
@@ -404,7 +407,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	SPAGAIN;
 
 	if (SvTRUE(ERRSV)) {
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR, "DLZ Perl: lookup died in eval: %s",
 			SvPV_nolen(ERRSV));
 		retval = ISC_R_FAILURE;
@@ -470,14 +473,13 @@ CLEAN_UP_AND_RETURN:
 	return (retval);
 }
 
-const char *
+static const char *
 #ifdef MULTIPLICITY
 missing_perl_method(const char *perl_class_name, PerlInterpreter *my_perl)
 #else  /* ifdef MULTIPLICITY */
 missing_perl_method(const char *perl_class_name)
 #endif /* ifdef MULTIPLICITY */
 {
-	const int BUF_LEN = 64; /* Should be big enough, right? hah */
 	char full_name[BUF_LEN];
 	const char *methods[] = { "new", "findzone", "lookup", NULL };
 	int i = 0;
@@ -499,8 +501,7 @@ isc_result_t
 dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	   ...) {
 	config_data_t *cd;
-	char *init_args[] = { NULL, NULL };
-	char *perlrun[] = { "", NULL, "dlz perl", NULL };
+	char *perlrun[] = { (char *)"", NULL, (char *)"dlz perl", NULL };
 	char *perl_class_name;
 	int r;
 	va_list ap;
@@ -610,9 +611,10 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	}
 
 #ifdef MULTIPLICITY
-	if (missing_method_name = missing_perl_method(perl_class_name, my_perl))
+	if ((missing_method_name = missing_perl_method(perl_class_name,
+						       my_perl)))
 #else  /* ifdef MULTIPLICITY */
-	if (missing_method_name = missing_perl_method(perl_class_name))
+	if ((missing_method_name = missing_perl_method(perl_class_name)))
 #endif /* ifdef MULTIPLICITY */
 	{
 		cd->log(ISC_LOG_ERROR,
@@ -654,7 +656,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	LEAVE;
 
 	if (SvTRUE(ERRSV)) {
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR, "DLZ Perl '%s': new died in eval: %s",
 			dlzname, SvPV_nolen(ERRSV));
 		goto CLEAN_UP_PERL_AND_FAIL;
diff --git a/contrib/dlz/modules/sqlite3/Makefile b/contrib/dlz/modules/sqlite3/Makefile
index b7861ded55..1532921b95 100644
--- a/contrib/dlz/modules/sqlite3/Makefile
+++ b/contrib/dlz/modules/sqlite3/Makefile
@@ -26,7 +26,7 @@
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 SQLITE3_LIBS=-lsqlite3
 
 all: dlz_sqlite3_dynamic.so
diff --git a/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c b/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
index 40d1820616..be6c6d7664 100644
--- a/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
+++ b/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
@@ -75,11 +75,11 @@ typedef struct {
  * SQLite3 result set
  */
 typedef struct {
-	char **pazResult;    /* Result of the query */
-	int pnRow;	     /* Number of result rows */
-	int pnColumn;	     /* Number of result columns */
-	unsigned int curRow; /* Current row */
-	char *pzErrmsg;	     /* Error message */
+	char **pazResult; /* Result of the query */
+	int pnRow;	  /* Number of result rows */
+	int pnColumn;	  /* Number of result columns */
+	int curRow;	  /* Current row */
+	char *pzErrmsg;	  /* Error message */
 } sqlite3_res_t;
 
 /* forward references */
@@ -444,7 +444,7 @@ static char **
 dlz_sqlite3_fetch_row(sqlite3_res_t *rs) {
 	char **retval = NULL;
 	if (rs != NULL) {
-		if (rs->pnRow > 0U && rs->curRow < rs->pnRow) {
+		if (rs->pnRow > 0 && rs->curRow < rs->pnRow) {
 			int index = (rs->curRow + 1) * rs->pnColumn;
 			retval = &rs->pazResult[index];
 			rs->curRow++;
diff --git a/contrib/dlz/modules/wildcard/Makefile b/contrib/dlz/modules/wildcard/Makefile
index d09a83a8be..087a3538e9 100644
--- a/contrib/dlz/modules/wildcard/Makefile
+++ b/contrib/dlz/modules/wildcard/Makefile
@@ -27,7 +27,7 @@
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 
 all: dlz_wildcard_dynamic.so
 
diff --git a/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c b/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c
index 3cb3ee1106..df22eaf688 100644
--- a/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c
+++ b/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c
@@ -224,7 +224,6 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	const char *p;
 	char *namebuf;
 	nrr_t *nrec;
-	bool origin = true;
 
 #if DLZ_DLOPEN_VERSION >= 2
 	UNUSED(methods);
@@ -249,9 +248,8 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 		strncpy(namebuf, zone, len - 1);
 		namebuf[len - 1] = '\0';
 		cd->record = namebuf;
-		origin = false;
 	} else if (p == zone) {
-		cd->record = "@";
+		cd->record = (char *)"@";
 	}
 
 	/* Write info message to log */
@@ -309,7 +307,7 @@ dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup) {
 	config_data_t *cd = (config_data_t *)dbdata;
 	char *querystring = NULL;
 	nrr_t *nrec;
-	const char *p, *name = "@";
+	const char *p;
 
 	p = shortest_match(cd->zone_pattern, zone);
 	if (p == NULL) {
@@ -325,7 +323,6 @@ dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup) {
 	result = ISC_R_NOTFOUND;
 	nrec = DLZ_LIST_HEAD(cd->rrs_list);
 	while (nrec != NULL) {
-		bool origin;
 		if (strcmp("@", nrec->name) == 0) {
 			isc_result_t presult;
 
@@ -391,7 +388,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	   ...) {
 	config_data_t *cd;
 	char *endp;
-	int i, def_ttl;
+	unsigned int i;
+	int def_ttl;
 	nrr_t *trec = NULL;
 	isc_result_t result;
 	const char *helper_name;