diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index cc9706082c..ece4848e1a 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -398,6 +398,9 @@ struct fetchctx {
 #define TRIEDFIND(f)            (((f)->attributes & FCTX_ATTR_TRIEDFIND) != 0)
 #define TRIEDALT(f)             (((f)->attributes & FCTX_ATTR_TRIEDALT) != 0)
 
+#define FCTX_ATTR_SET(f, x) do { (f)->attributes |= (x); } while (0)
+#define FCTX_ATTR_CLR(f, x) do { (f)->attributes &= ~(x); } while (0)
+
 typedef struct {
 	dns_adbaddrinfo_t *		addrinfo;
 	fetchctx_t *			fctx;
@@ -1476,7 +1479,7 @@ fctx_done(fetchctx_t *fctx, isc_result_t result, int line) {
 	LOCK(&res->buckets[fctx->bucketnum].lock);
 
 	fctx->state = fetchstate_done;
-	fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
+	FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
 	fctx_sendevents(fctx, result, line);
 
 	UNLOCK(&res->buckets[fctx->bucketnum].lock);
@@ -1545,7 +1548,7 @@ process_sendevent(resquery_t *query, isc_event_t *event) {
 		 * Behave as if the idle timer has expired.  For TCP
 		 * this may not actually reflect the latest timer.
 		 */
-		fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
+		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
 		result = fctx_stopidletimer(fctx);
 		if (result != ISC_R_SUCCESS)
 			fctx_done(fctx, result, __LINE__);
@@ -2785,7 +2788,7 @@ resquery_connected(isc_task_t *task, isc_event_t *event) {
 		 * Behave as if the idle timer has expired.  For TCP
 		 * connections this may not actually reflect the latest timer.
 		 */
-		fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
+		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
 		result = fctx_stopidletimer(fctx);
 		if (result != ISC_R_SUCCESS)
 			fctx_done(fctx, result, __LINE__);
@@ -2826,7 +2829,7 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {
 		 */
 		INSIST(!fctx->shuttingdown);
 		if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES) {
-			fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
+			FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
 			want_try = true;
 		} else {
 			fctx->findfail++;
@@ -2836,7 +2839,7 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {
 				 * know the answer.  There's nothing to do but
 				 * fail the fctx.
 				 */
-				fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
+				FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
 				want_done = true;
 			}
 		}
@@ -3636,7 +3639,7 @@ fctx_nextaddress(fetchctx_t *fctx) {
 	 * No forwarders.  Move to the next find.
 	 */
 
-	fctx->attributes |= FCTX_ATTR_TRIEDFIND;
+	FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDFIND);
 
 	find = fctx->find;
 	if (find == NULL)
@@ -3681,7 +3684,7 @@ fctx_nextaddress(fetchctx_t *fctx) {
 	 * No nameservers left.  Try alternates.
 	 */
 
-	fctx->attributes |= FCTX_ATTR_TRIEDALT;
+	FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDALT);
 
 	find = fctx->altfind;
 	if (find == NULL)
@@ -3790,7 +3793,7 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 			 * Sleep waiting for addresses.
 			 */
 			FCTXTRACE("addrwait");
-			fctx->attributes |= FCTX_ATTR_ADDRWAIT;
+			FCTX_ATTR_SET(fctx, FCTX_ATTR_ADDRWAIT);
 			return;
 		} else if (result != ISC_R_SUCCESS) {
 			/*
@@ -3992,7 +3995,7 @@ fctx_timeout(isc_task_t *task, isc_event_t *event) {
 			FCTXTRACE("query timed out; no response");
 			fctx_cancelquery(&query, NULL, NULL, true, false);
 		}
-		fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
+		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
 
 		/*
 		 * Our timer has triggered.  Reestablish the fctx lifetime
@@ -4064,7 +4067,7 @@ fctx_doshutdown(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * An fctx that is shutting down is no longer in ADDRWAIT mode.
 	 */
-	fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
+	FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
 
 	/*
 	 * Cancel all pending validators.  Note that this must be done
@@ -5215,7 +5218,7 @@ validated(isc_task_t *task, isc_event_t *event) {
 	 * as opposed to an error.  'node' must be non-NULL.
 	 */
 
-	fctx->attributes |= FCTX_ATTR_HAVEANSWER;
+	FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER);
 
 	if (hevent != NULL) {
 		/*
@@ -5842,7 +5845,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
 	}
 
 	if (result == ISC_R_SUCCESS && have_answer) {
-		fctx->attributes |= FCTX_ATTR_HAVEANSWER;
+		FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER);
 		if (event != NULL) {
 			/*
 			 * Negative results must be indicated in event->result.
@@ -5882,7 +5885,7 @@ cache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now)
 
 	FCTXTRACE("cache_message");
 
-	fctx->attributes &= ~FCTX_ATTR_WANTCACHE;
+	FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTCACHE);
 
 	LOCK(&fctx->res->buckets[fctx->bucketnum].lock);
 
@@ -5987,7 +5990,7 @@ ncache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 
 	FCTXTRACE("ncache_message");
 
-	fctx->attributes &= ~FCTX_ATTR_WANTNCACHE;
+	FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTNCACHE);
 
 	res = fctx->res;
 	need_validation = false;
@@ -6114,7 +6117,7 @@ ncache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 		goto unlock;
 
 	if (!HAVE_ANSWER(fctx)) {
-		fctx->attributes |= FCTX_ATTR_HAVEANSWER;
+		FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER);
 		if (event != NULL) {
 			event->result = eresult;
 			if (adbp != NULL && *adbp != NULL) {
@@ -6893,7 +6896,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 		 * query domain.
 		 */
 		INSIST(ns_rdataset != NULL);
-		fctx->attributes |= FCTX_ATTR_GLUING;
+		FCTX_ATTR_SET(fctx, FCTX_ATTR_GLUING);
 		(void)dns_rdataset_additionaldata(ns_rdataset, check_related,
 						  fctx);
 #if CHECK_FOR_GLUE_IN_ANSWER
@@ -6910,7 +6913,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 			(void)dns_rdataset_additionaldata(ns_rdataset,
 							  check_answer, fctx);
 #endif
-		fctx->attributes &= ~FCTX_ATTR_GLUING;
+		FCTX_ATTR_CLR(fctx, FCTX_ATTR_GLUING);
 		/*
 		 * NS rdatasets with 0 TTL cause problems.
 		 * dns_view_findzonecut() will not find them when we
@@ -6938,7 +6941,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 		result = fcount_incr(fctx, true);
 		if (result != ISC_R_SUCCESS)
 			return (result);
-		fctx->attributes |= FCTX_ATTR_WANTCACHE;
+		FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE);
 		fctx->ns_ttl_ok = false;
 		log_ns_ttl(fctx, "DELEGATION");
 		return (DNS_R_DELEGATION);
@@ -6952,7 +6955,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 		ns_name->attributes &= ~DNS_NAMEATTR_CACHE;
 
 	if (negative_response && oqname == NULL)
-		fctx->attributes |= FCTX_ATTR_WANTNCACHE;
+		FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTNCACHE);
 
 	return (ISC_R_SUCCESS);
 }
@@ -7261,7 +7264,7 @@ answer_response(fetchctx_t *fctx) {
 	/*
 	 * This response is now potentially cacheable.
 	 */
-	fctx->attributes |= FCTX_ATTR_WANTCACHE;
+	FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE);
 
 	/*
 	 * Did chaining end before we got the final answer?
@@ -8418,7 +8421,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Clear cache bits.
 	 */
-	fctx->attributes &= ~(FCTX_ATTR_WANTNCACHE | FCTX_ATTR_WANTCACHE);
+	FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTNCACHE | FCTX_ATTR_WANTCACHE);
 
 	/*
 	 * Did we get any answers?