diff --git a/CHANGES b/CHANGES
index a2364e7ea9..3be826f32d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3368.	[bug]		<dns/iptable.h>, <dns/private.h> and <dns/zone.h>
+			where not C++ safe.
+
 3367.	[bug]		dns_dnsseckey_create() result was not being checked.
 			[RT #30685]
 
diff --git a/lib/dns/include/dns/iptable.h b/lib/dns/include/dns/iptable.h
index d7eb140dc0..6662ecb866 100644
--- a/lib/dns/include/dns/iptable.h
+++ b/lib/dns/include/dns/iptable.h
@@ -23,6 +23,8 @@
 #include <isc/magic.h>
 #include <isc/radix.h>
 
+#include <dns/types.h>
+
 struct dns_iptable {
 	unsigned int		magic;
 	isc_mem_t		*mctx;
diff --git a/lib/dns/include/dns/private.h b/lib/dns/include/dns/private.h
index 91fff5f752..dd16b2e7a0 100644
--- a/lib/dns/include/dns/private.h
+++ b/lib/dns/include/dns/private.h
@@ -51,15 +51,15 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
  */
 
 isc_result_t
-dns_private_totext(dns_rdata_t *private, isc_buffer_t *buffer);
+dns_private_totext(dns_rdata_t *privaterdata, isc_buffer_t *buffer);
 /*%<
- * Convert a private-type RR 'private' to human-readable form,
+ * Convert a private-type RR 'privaterdata' to human-readable form,
  * and place the result in 'buffer'.  The text should indicate
  * which action the private-type record specifies and whether the
  * action has been completed.
  *
  * Requires:
- * \li	'private' is a valid rdata containing at least five bytes
+ * \li	'privaterdata' is a valid rdata containing at least five bytes
  * \li	'buffer' is a valid buffer
  *
  * Returns:
diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index 0c5a499fca..60c87e1cb6 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -1861,7 +1861,7 @@ dns_zone_setsignatures(dns_zone_t *zone, isc_uint32_t signatures);
 
 isc_result_t
 dns_zone_signwithkey(dns_zone_t *zone, dns_secalg_t algorithm,
-		     isc_uint16_t keyid, isc_boolean_t delete);
+		     isc_uint16_t keyid, isc_boolean_t deleteit);
 /*%<
  * Initiate/resume signing of the entire zone with the zone DNSKEY(s)
  * that match the given algorithm and keyid.