diff --git a/bin/named/server.c b/bin/named/server.c
index b341f4b7de..73d8fd1fde 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -2877,7 +2877,7 @@ cleanup:
 		cfg_obj_destroy(cfg->add_parser, &zoneconf);
 	}
 	dns_catz_entry_detach(ev->origin, &ev->entry);
-	dns_catz_zone_detach(&ev->origin);
+	dns_catz_detach_catz(&ev->origin);
 	dns_view_detach(&ev->view);
 	isc_event_free(ISC_EVENT_PTR(&ev));
 }
@@ -2952,7 +2952,7 @@ cleanup:
 		dns_zone_detach(&zone);
 	}
 	dns_catz_entry_detach(ev->origin, &ev->entry);
-	dns_catz_zone_detach(&ev->origin);
+	dns_catz_detach_catz(&ev->origin);
 	dns_view_detach(&ev->view);
 	isc_event_free(ISC_EVENT_PTR(&ev));
 }
@@ -2994,7 +2994,7 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	event->mod = (type == DNS_EVENT_CATZMODZONE);
 
 	dns_catz_entry_attach(entry, &event->entry);
-	dns_catz_zone_attach(origin, &event->origin);
+	dns_catz_attach_catz(origin, &event->origin);
 	dns_view_attach(view, &event->view);
 
 	isc_task_send(task, ISC_EVENT_PTR(&event));
@@ -3161,7 +3161,7 @@ static dns_catz_zonemodmethods_t ns_catz_zonemodmethods = {
 static isc_result_t
 configure_catz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *config,
 	       const cfg_obj_t *catz_obj) {
-	const cfg_listelt_t *zone_element;
+	const cfg_listelt_t *zone_element = NULL;
 	const dns_catz_zones_t *old = NULL;
 	bool pview_must_detach = false;
 	isc_result_t result;
@@ -3189,9 +3189,9 @@ configure_catz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *config,
 	}
 
 	if (old != NULL) {
-		dns_catz_catzs_detach(&view->catzs);
-		dns_catz_catzs_attach(pview->catzs, &view->catzs);
-		dns_catz_catzs_detach(&pview->catzs);
+		dns_catz_detach_catzs(&view->catzs);
+		dns_catz_attach_catzs(pview->catzs, &view->catzs);
+		dns_catz_detach_catzs(&pview->catzs);
 		dns_catz_prereconfig(view->catzs);
 	}
 
diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index 4717b96c16..4edc8c80ec 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -851,7 +851,7 @@ dns_catz_add_zone(dns_catz_zones_t *catzs, const dns_name_t *name,
 	result = isc_ht_add(catzs->zones, catz->name.ndata, catz->name.length,
 			    catz);
 	if (result != ISC_R_SUCCESS) {
-		dns_catz_zone_detach(&catz);
+		dns_catz_detach_catz(&catz);
 		if (result != ISC_R_EXISTS) {
 			goto cleanup;
 		}
@@ -889,130 +889,105 @@ dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name) {
 	return (found);
 }
 
-void
-dns_catz_catzs_attach(dns_catz_zones_t *catzs, dns_catz_zones_t **catzsp) {
-	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
-	REQUIRE(catzsp != NULL && *catzsp == NULL);
+static void
+dns__catz_zone_destroy(dns_catz_zone_t *catz) {
+	isc_mem_t *mctx = catz->catzs->mctx;
 
-	isc_refcount_increment(&catzs->references);
-	*catzsp = catzs;
-}
+	if (catz->entries != NULL) {
+		isc_ht_iter_t *iter = NULL;
+		isc_result_t result;
+		isc_ht_iter_create(catz->entries, &iter);
+		for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;
+		     result = isc_ht_iter_delcurrent_next(iter))
+		{
+			dns_catz_entry_t *entry = NULL;
 
-void
-dns_catz_zone_attach(dns_catz_zone_t *catz, dns_catz_zone_t **catzp) {
-	REQUIRE(catzp != NULL && *catzp == NULL);
-
-	isc_refcount_increment(&catz->references);
-	*catzp = catz;
-}
-
-void
-dns_catz_zone_detach(dns_catz_zone_t **catzp) {
-	REQUIRE(catzp != NULL && *catzp != NULL);
-	dns_catz_zone_t *catz = *catzp;
-	*catzp = NULL;
-
-	if (isc_refcount_decrement(&catz->references) == 1) {
-		isc_mem_t *mctx = catz->catzs->mctx;
-		isc_refcount_destroy(&catz->references);
-		if (catz->entries != NULL) {
-			isc_ht_iter_t *iter = NULL;
-			isc_result_t result;
-			isc_ht_iter_create(catz->entries, &iter);
-			for (result = isc_ht_iter_first(iter);
-			     result == ISC_R_SUCCESS;
-			     result = isc_ht_iter_delcurrent_next(iter))
-			{
-				dns_catz_entry_t *entry = NULL;
-
-				isc_ht_iter_current(iter, (void **)&entry);
-				dns_catz_entry_detach(catz, &entry);
-			}
-			INSIST(result == ISC_R_NOMORE);
-			isc_ht_iter_destroy(&iter);
-
-			/* The hashtable has to be empty now. */
-			INSIST(isc_ht_count(catz->entries) == 0);
-			isc_ht_destroy(&catz->entries);
+			isc_ht_iter_current(iter, (void **)&entry);
+			dns_catz_entry_detach(catz, &entry);
 		}
-		if (catz->coos != NULL) {
-			isc_ht_iter_t *iter = NULL;
-			isc_result_t result;
-			isc_ht_iter_create(catz->coos, &iter);
-			for (result = isc_ht_iter_first(iter);
-			     result == ISC_R_SUCCESS;
-			     result = isc_ht_iter_delcurrent_next(iter))
-			{
-				dns_catz_coo_t *coo = NULL;
+		INSIST(result == ISC_R_NOMORE);
+		isc_ht_iter_destroy(&iter);
 
-				isc_ht_iter_current(iter, (void **)&coo);
-				catz_coo_detach(catz, &coo);
-			}
-			INSIST(result == ISC_R_NOMORE);
-			isc_ht_iter_destroy(&iter);
-
-			/* The hashtable has to be empty now. */
-			INSIST(isc_ht_count(catz->coos) == 0);
-			isc_ht_destroy(&catz->coos);
-		}
-		catz->magic = 0;
-		isc_timer_destroy(&catz->updatetimer);
-		if (catz->db_registered) {
-			dns_db_updatenotify_unregister(
-				catz->db, dns_catz_dbupdate_callback,
-				catz->catzs);
-		}
-		if (catz->dbversion) {
-			dns_db_closeversion(catz->db, &catz->dbversion, false);
-		}
-		if (catz->db != NULL) {
-			dns_db_detach(&catz->db);
-		}
-
-		dns_name_free(&catz->name, mctx);
-		dns_catz_options_free(&catz->defoptions, mctx);
-		dns_catz_options_free(&catz->zoneoptions, mctx);
-
-		catz->catzs = NULL;
-		isc_mem_put(mctx, catz, sizeof(*catz));
+		/* The hashtable has to be empty now. */
+		INSIST(isc_ht_count(catz->entries) == 0);
+		isc_ht_destroy(&catz->entries);
 	}
-}
+	if (catz->coos != NULL) {
+		isc_ht_iter_t *iter = NULL;
+		isc_result_t result;
+		isc_ht_iter_create(catz->coos, &iter);
+		for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;
+		     result = isc_ht_iter_delcurrent_next(iter))
+		{
+			dns_catz_coo_t *coo = NULL;
 
-void
-dns_catz_catzs_detach(dns_catz_zones_t **catzsp) {
-	dns_catz_zones_t *catzs;
-
-	REQUIRE(catzsp != NULL && DNS_CATZ_ZONES_VALID(*catzsp));
-
-	catzs = *catzsp;
-	*catzsp = NULL;
-
-	if (isc_refcount_decrement(&catzs->references) == 1) {
-		catzs->magic = 0;
-		isc_task_destroy(&catzs->updater);
-		isc_mutex_destroy(&catzs->lock);
-		if (catzs->zones != NULL) {
-			isc_ht_iter_t *iter = NULL;
-			isc_result_t result;
-			isc_ht_iter_create(catzs->zones, &iter);
-			for (result = isc_ht_iter_first(iter);
-			     result == ISC_R_SUCCESS;)
-			{
-				dns_catz_zone_t *catz = NULL;
-				isc_ht_iter_current(iter, (void **)&catz);
-				result = isc_ht_iter_delcurrent_next(iter);
-				dns_catz_zone_detach(&catz);
-			}
-			INSIST(result == ISC_R_NOMORE);
-			isc_ht_iter_destroy(&iter);
-			INSIST(isc_ht_count(catzs->zones) == 0);
-			isc_ht_destroy(&catzs->zones);
+			isc_ht_iter_current(iter, (void **)&coo);
+			catz_coo_detach(catz, &coo);
 		}
-		isc_refcount_destroy(&catzs->references);
-		isc_mem_putanddetach(&catzs->mctx, catzs, sizeof(*catzs));
+		INSIST(result == ISC_R_NOMORE);
+		isc_ht_iter_destroy(&iter);
+
+		/* The hashtable has to be empty now. */
+		INSIST(isc_ht_count(catz->coos) == 0);
+		isc_ht_destroy(&catz->coos);
 	}
+	catz->magic = 0;
+	isc_timer_destroy(&catz->updatetimer);
+	if (catz->db_registered) {
+		dns_db_updatenotify_unregister(
+			catz->db, dns_catz_dbupdate_callback, catz->catzs);
+	}
+	if (catz->dbversion != NULL) {
+		dns_db_closeversion(catz->db, &catz->dbversion, false);
+	}
+	if (catz->db != NULL) {
+		dns_db_detach(&catz->db);
+	}
+
+	dns_name_free(&catz->name, mctx);
+	dns_catz_options_free(&catz->defoptions, mctx);
+	dns_catz_options_free(&catz->zoneoptions, mctx);
+
+	catz->catzs = NULL;
+	isc_refcount_destroy(&catz->references);
+
+	isc_mem_put(mctx, catz, sizeof(*catz));
 }
 
+static void
+dns__catz_zones_destroy(dns_catz_zones_t *catzs) {
+	if (catzs->zones != NULL) {
+		isc_ht_iter_t *iter = NULL;
+		isc_result_t result;
+		isc_ht_iter_create(catzs->zones, &iter);
+		for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;)
+		{
+			dns_catz_zone_t *zone = NULL;
+			isc_ht_iter_current(iter, (void **)&zone);
+			result = isc_ht_iter_delcurrent_next(iter);
+			dns_catz_detach_catz(&zone);
+		}
+		INSIST(result == ISC_R_NOMORE);
+		isc_ht_iter_destroy(&iter);
+		INSIST(isc_ht_count(catzs->zones) == 0);
+		isc_ht_destroy(&catzs->zones);
+	}
+	catzs->magic = 0;
+	isc_task_destroy(&catzs->updater);
+	isc_mutex_destroy(&catzs->lock);
+	isc_refcount_destroy(&catzs->references);
+
+	isc_mem_putanddetach(&catzs->mctx, catzs, sizeof(*catzs));
+}
+
+#ifdef DNS_CATZ_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_catz_zone, dns__catz_zone_destroy);
+ISC_REFCOUNT_TRACE_IMPL(dns_catz_zones, dns__catz_zones_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_catz_zone, dns__catz_zone_destroy);
+ISC_REFCOUNT_IMPL(dns_catz_zones, dns__catz_zones_destroy);
+#endif
+
 typedef enum {
 	CATZ_OPT_NONE,
 	CATZ_OPT_ZONES,
@@ -2187,7 +2162,7 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 
 	result = dns_db_createiterator(db, DNS_DB_NONSEC3, &it);
 	if (result != ISC_R_SUCCESS) {
-		dns_catz_zone_detach(&newcatz);
+		dns_catz_detach_catz(&newcatz);
 		dns_db_closeversion(db, &oldcatz->dbversion, false);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
@@ -2206,7 +2181,7 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 	result = dns_name_fromstring2(name, "version", &db->origin, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		dns_dbiterator_destroy(&it);
-		dns_catz_zone_detach(&newcatz);
+		dns_catz_detach_catz(&newcatz);
 		dns_db_closeversion(db, &oldcatz->dbversion, false);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
@@ -2351,7 +2326,7 @@ final:
 			      "catz: new catalog zone '%s' is broken and "
 			      "will not be processed",
 			      bname);
-		dns_catz_zone_detach(&newcatz);
+		dns_catz_detach_catz(&newcatz);
 		return;
 	}
 
@@ -2359,7 +2334,7 @@ final:
 	 * Finally merge new zone into old zone.
 	 */
 	result = dns_catz_zones_merge(oldcatz, newcatz);
-	dns_catz_zone_detach(&newcatz);
+	dns_catz_detach_catz(&newcatz);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
@@ -2437,12 +2412,12 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs) {
 						   &catz->name);
 			INSIST(result == ISC_R_SUCCESS);
 			dns_catz_zones_merge(catz, newcatz);
-			dns_catz_zone_detach(&newcatz);
+			dns_catz_detach_catz(&newcatz);
 
 			/* Make sure that we have an empty catalog zone. */
 			INSIST(isc_ht_count(catz->entries) == 0);
 			result = isc_ht_iter_delcurrent_next(iter);
-			dns_catz_zone_detach(&catz);
+			dns_catz_detach_catz(&catz);
 		} else {
 			result = isc_ht_iter_next(iter);
 		}
diff --git a/lib/dns/include/dns/catz.h b/lib/dns/include/dns/catz.h
index dd65ceedc4..049d76e622 100644
--- a/lib/dns/include/dns/catz.h
+++ b/lib/dns/include/dns/catz.h
@@ -13,6 +13,11 @@
 
 #pragma once
 
+/*
+ * Define this for reference count tracing in the unit
+ */
+#undef DNS_CATZ_TRACE
+
 #include <inttypes.h>
 #include <stdbool.h>
 
@@ -203,25 +208,6 @@ dns_catz_entry_cmp(const dns_catz_entry_t *ea, const dns_catz_entry_t *eb);
  * \li 'false' if the entries differ.
  */
 
-void
-dns_catz_zone_attach(dns_catz_zone_t *zone, dns_catz_zone_t **zonep);
-/*%<
- * Attach a catzone
- *
- * Requires:
- * \li	'zone' is a valid dns_catz_zone_t.
- * \li	'zonep' is not NULL and '*zonep' is NULL.
- */
-
-void
-dns_catz_zone_detach(dns_catz_zone_t **zonep);
-/*%<
- * Detach a zone, free if no further references
- *
- * Requires:
- * \li	'zonep' is not NULL and '*zonep' is not NULL.
- */
-
 isc_result_t
 dns_catz_new_zone(dns_catz_zones_t *catzs, dns_catz_zone_t **catzp,
 		  const dns_name_t *name);
@@ -373,25 +359,6 @@ dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name);
  * \li	'name' is a valid dns_name_t.
  */
 
-void
-dns_catz_catzs_attach(dns_catz_zones_t *catzs, dns_catz_zones_t **catzsp);
-/*%<
- * Attach 'catzs' to 'catzsp'.
- *
- * Requires:
- * \li	'catzs' is a valid dns_catz_zones_t.
- * \li	'catzsp' is not NULL and *catzsp is NULL.
- */
-
-void
-dns_catz_catzs_detach(dns_catz_zones_t **catzsp);
-/*%<
- * Detach 'catzsp', free if no further references.
- *
- * Requires:
- * \li	'catzsp' is not NULL and *catzsp is not NULL.
- */
-
 void
 dns_catz_catzs_set_view(dns_catz_zones_t *catzs, dns_view_t *view);
 /*%<
@@ -470,4 +437,43 @@ dns_catz_get_iterator(dns_catz_zone_t *catz, isc_ht_iter_t **itp);
  *
  */
 
+#ifdef DNS_CATZ_TRACE
+/* Compatibility macros */
+#define dns_catz_attach_catz(catz, catzp) \
+	dns_catz_zone__attach(catz, catzp, __func__, __FILE__, __LINE__)
+#define dns_catz_detach_catz(catzp) \
+	dns_catz_zone__detach(catzp, __func__, __FILE__, __LINE__)
+#define dns_catz_ref_catz(ptr) \
+	dns_catz_zone__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_catz_unref_catz(ptr) \
+	dns_catz_zone__unref(ptr, __func__, __FILE__, __LINE__)
+
+#define dns_catz_attach_catzs(catzs, catzsp) \
+	dns_catz_zones__attach(catzs, catzsp, __func__, __FILE__, __LINE__)
+#define dns_catz_detach_catzs(catzsp) \
+	dns_catz_zones__detach(catzsp, __func__, __FILE__, __LINE__)
+#define dns_catz_ref_catzs(ptr) \
+	dns_catz_zones__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_catz_unref_catzs(ptr) \
+	dns_catz_zones__unref(ptr, __func__, __FILE__, __LINE__)
+
+ISC_REFCOUNT_TRACE_DECL(dns_catz_zone);
+ISC_REFCOUNT_TRACE_DECL(dns_catz_zones);
+#else
+/* Compatibility macros */
+#define dns_catz_attach_catz(catz, catzp) dns_catz_zone_attach(catz, catzp)
+#define dns_catz_detach_catz(catzp)	  dns_catz_zone_detach(catzp)
+#define dns_catz_ref_catz(ptr)		  dns_catz_zone_ref(ptr)
+#define dns_catz_unref_catz(ptr)	  dns_catz_zone_unref(ptr)
+
+#define dns_catz_attach_catzs(catzs, catzsp) \
+	dns_catz_zones_attach(catzs, catzsp)
+#define dns_catz_detach_catzs(catzsp) dns_catz_zones_detach(catzsp)
+#define dns_catz_ref_catzs(ptr)	      dns_catz_zones_ref(ptr)
+#define dns_catz_unref_catzs(ptr)     dns_catz_zones_unref(ptr)
+
+ISC_REFCOUNT_DECL(dns_catz_zone);
+ISC_REFCOUNT_DECL(dns_catz_zones);
+#endif /* DNS_CATZ_TRACE */
+
 ISC_LANG_ENDDECLS
diff --git a/lib/dns/view.c b/lib/dns/view.c
index 4ef3439ce7..755f69c8e7 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -423,7 +423,7 @@ destroy(dns_view_t *view) {
 		dns_rpz_detach_rpzs(&view->rpzs);
 	}
 	if (view->catzs != NULL) {
-		dns_catz_catzs_detach(&view->catzs);
+		dns_catz_detach_catzs(&view->catzs);
 	}
 	for (dlzdb = ISC_LIST_HEAD(view->dlz_searched); dlzdb != NULL;
 	     dlzdb = ISC_LIST_HEAD(view->dlz_searched))
@@ -680,7 +680,7 @@ view_flushanddetach(dns_view_t **viewp, bool flush) {
 			}
 		}
 		if (view->catzs != NULL) {
-			dns_catz_catzs_detach(&view->catzs);
+			dns_catz_detach_catzs(&view->catzs);
 		}
 		if (view->ntatable_priv != NULL) {
 			dns_ntatable_shutdown(view->ntatable_priv);
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 579c9da869..c9bb345156 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1328,7 +1328,7 @@ zone_free(dns_zone_t *zone) {
 		zone->rpz_num = DNS_RPZ_INVALID_NUM;
 	}
 	if (zone->catzs != NULL) {
-		dns_catz_catzs_detach(&zone->catzs);
+		dns_catz_detach_catzs(&zone->catzs);
 	}
 	zone_freedbargs(zone);
 	dns_zone_setparentals(zone, NULL, NULL, NULL, 0);
@@ -1981,7 +1981,7 @@ zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs) {
 	INSIST(zone->catzs == NULL || zone->catzs == catzs);
 	dns_catz_catzs_set_view(catzs, zone->view);
 	if (zone->catzs == NULL) {
-		dns_catz_catzs_attach(catzs, &zone->catzs);
+		dns_catz_attach_catzs(catzs, &zone->catzs);
 	}
 }
 
@@ -2002,7 +2002,7 @@ zone_catz_disable(dns_zone_t *zone) {
 		if (zone->db != NULL) {
 			dns_zone_catz_disable_db(zone, zone->db);
 		}
-		dns_catz_catzs_detach(&zone->catzs);
+		dns_catz_detach_catzs(&zone->catzs);
 	}
 }