diff --git a/src/context.c b/src/context.c
index 5a720023..8a020677 100644
--- a/src/context.c
+++ b/src/context.c
@@ -330,16 +330,15 @@ static void destroy_local_host(_getdns_rbnode_t * node, void *arg)
  * TODO: Determine from OS
  */
 static getdns_return_t
-create_default_namespaces(struct getdns_context *context)
+create_default_namespaces(getdns_context *context)
 {
-	context->namespaces = GETDNS_XMALLOC(context->my_mf, getdns_namespace_t, 2);
-	if(context->namespaces == NULL)
-		return GETDNS_RETURN_GENERIC_ERROR;
+	if (!( context->namespaces
+	     = GETDNS_XMALLOC(context->my_mf, getdns_namespace_t, 2)))
+		return GETDNS_RETURN_MEMORY_ERROR;
 
 	context->namespaces[0] = GETDNS_NAMESPACE_LOCALNAMES;
 	context->namespaces[1] = GETDNS_NAMESPACE_DNS;
 	context->namespace_count = 2;
-
 	return GETDNS_RETURN_GOOD;
 }
 
@@ -347,11 +346,11 @@ create_default_namespaces(struct getdns_context *context)
  * Helper to get default transports.
  */
 static getdns_return_t
-create_default_dns_transports(struct getdns_context *context)
+create_default_dns_transports(getdns_context *context)
 {
-	context->dns_transports = GETDNS_XMALLOC(context->my_mf, getdns_transport_list_t, 2);
-	if(context->dns_transports == NULL)
-		return GETDNS_RETURN_GENERIC_ERROR;
+	if (!( context->dns_transports
+	     = GETDNS_XMALLOC(context->my_mf, getdns_transport_list_t, 2)))
+		return GETDNS_RETURN_MEMORY_ERROR;
 
 	context->dns_transports[0] = GETDNS_TRANSPORT_UDP;
 	context->dns_transports[1] = GETDNS_TRANSPORT_TCP;
@@ -415,7 +414,7 @@ local_host_cmp(const void *id1, const void *id2)
 }
 
 /** return 0 on success */
-static int
+static getdns_return_t
 add_local_host(getdns_context *context, getdns_dict *address, const char *str)
 {
 	uint8_t host_name[256];
@@ -424,9 +423,10 @@ add_local_host(getdns_context *context, getdns_dict *address, const char *str)
 	getdns_bindata *address_type;
 	int hnas_found = 0;
 	getdns_list **addrs;
+	getdns_return_t r;
 
 	if (gldns_str2wire_dname_buf(str, host_name, &host_name_len))
-		return -1;
+		return GETDNS_RETURN_BAD_DOMAIN_NAME;
 
 	canonicalize_dname(host_name);
 	
@@ -435,7 +435,7 @@ add_local_host(getdns_context *context, getdns_dict *address, const char *str)
 
 		if (!(hnas = (host_name_addrs *)GETDNS_XMALLOC(context->mf,
 		    uint8_t, sizeof(host_name_addrs) + host_name_len)))
-			return -1;
+			return GETDNS_RETURN_MEMORY_ERROR;
 
 		hnas->ipv4addrs = NULL;
 		hnas->ipv6addrs = NULL;
@@ -445,35 +445,33 @@ add_local_host(getdns_context *context, getdns_dict *address, const char *str)
 	} else
 		hnas_found = 1;
 	
-	if (getdns_dict_get_bindata(address, "address_type", &address_type) ||
-
-	    address_type->size < 4 ||
-
-	    !(addrs = address_type->data[3] == '4'? &hnas->ipv4addrs
+	if ((r = getdns_dict_get_bindata(address,"address_type",&address_type))
+	||  address_type->size < 4
+	||  !(addrs = address_type->data[3] == '4'? &hnas->ipv4addrs
 	            : address_type->data[3] == '6'? &hnas->ipv4addrs : NULL)) {
 
 		if (!hnas_found) GETDNS_FREE(context->mf, hnas);
-		return -1;
+		return r ? r : GETDNS_RETURN_WRONG_TYPE_REQUESTED;
 	}
 	if (!*addrs && !(*addrs = getdns_list_create_with_context(context))) {
 		if (!hnas_found) GETDNS_FREE(context->mf, hnas);
-		return -1;
+		return GETDNS_RETURN_MEMORY_ERROR;
 	}
-	if (_getdns_list_append_this_dict(*addrs, address)) {
+	if ((r = _getdns_list_append_this_dict(*addrs, address))) {
 	       	if (!hnas_found) {
 			getdns_list_destroy(*addrs);
 			GETDNS_FREE(context->mf, hnas);
 		}
-		return -1;
+		return r;
 
 	} else if (!hnas_found)
 		(void)_getdns_rbtree_insert(&context->local_hosts, &hnas->node);
 
-	return 0;
+	return GETDNS_RETURN_GOOD;
 }
 
 static getdns_dict *
-sockaddr_dict(getdns_context *context, struct sockaddr *sa)
+sockaddr_dict(const getdns_context *context, struct sockaddr *sa)
 {
 	getdns_dict *address = getdns_dict_create_with_context(context);
 	char addrstr[1024], *b;
@@ -591,7 +589,7 @@ getdns_return_t
 getdns_context_set_hosts(getdns_context *context, const char *hosts)
 {
 	/* enough space in buf for longest allowed domain name */
-	char buf[1024];
+	char buf[2048];
 	char *pos = buf, prev_c, *start_of_word = NULL;
 	FILE *in;
 	int start_of_line = 1;
@@ -603,7 +601,7 @@ getdns_context_set_hosts(getdns_context *context, const char *hosts)
 	if (!(in = fopen(hosts, "r")))
 		return GETDNS_RETURN_IO_ERROR;
 
-	(void)strlcpy(context->fchg_hosts.fn, hosts, _GETDNS_PATH_MAX);
+	(void) strlcpy(context->fchg_hosts.fn, hosts, _GETDNS_PATH_MAX);
 	(void) memset(&context->fchg_hosts.prevstat, 0, sizeof(struct stat));
 	context->fchg_hosts.changes = GETDNS_FCHG_NOCHANGES;
 	context->fchg_hosts.errors = GETDNS_FCHG_NOERROR;
@@ -695,7 +693,7 @@ read_more:	;
 }
 
 getdns_return_t
-getdns_context_get_hosts(getdns_context *context, const char **hosts)
+getdns_context_get_hosts(const getdns_context *context, const char **hosts)
 {
 	if (!context || !hosts)
 		return GETDNS_RETURN_INVALID_PARAMETER;
@@ -1193,7 +1191,7 @@ set_os_defaults_windows(getdns_context *context)
 
     info = (FIXED_INFO *)malloc(sizeof(FIXED_INFO));
     if (info == NULL)
-		return GETDNS_RETURN_GENERIC_ERROR;
+		return GETDNS_RETURN_MEMORY_ERROR;
 
 	if ((info_err = GetNetworkParams(info, &buflen)) == ERROR_BUFFER_OVERFLOW) {
 		free(info);
@@ -1373,7 +1371,8 @@ getdns_context_set_resolvconf(getdns_context *context, const char *resolvconf)
 #endif
 
 getdns_return_t
-getdns_context_get_resolvconf(getdns_context *context, const char **resolvconf)
+getdns_context_get_resolvconf(
+    const getdns_context *context, const char **resolvconf)
 {
 	if (!context || !resolvconf)
 		return GETDNS_RETURN_INVALID_PARAMETER;
@@ -1897,7 +1896,8 @@ getdns_context_set_update_callback(getdns_context *context, void *userarg,
 }
 
 getdns_return_t
-getdns_context_get_update_callback(getdns_context *context, void **userarg,
+getdns_context_get_update_callback(const getdns_context *context,
+    void **userarg,
     void (**cb)(getdns_context *, getdns_context_code_t, void *))
 {
 	if (!context || !userarg || !cb)
@@ -3854,7 +3854,7 @@ _getdns_bindata_destroy(struct mem_funcs *mfs,
 /* TODO: Remove next_timeout argument from getdns_context_get_num_pending_requests
  */
 uint32_t
-getdns_context_get_num_pending_requests(getdns_context* context,
+getdns_context_get_num_pending_requests(const getdns_context* context,
     struct timeval* next_timeout)
 {
 	(void)next_timeout;
@@ -3928,7 +3928,8 @@ getdns_context_set_eventloop(getdns_context* context, getdns_eventloop* loop)
 }
 
 getdns_return_t
-getdns_context_get_eventloop(getdns_context *context, getdns_eventloop **loop)
+getdns_context_get_eventloop(
+    const getdns_context *context, getdns_eventloop **loop)
 {
 	if (!context || !loop)
 		return GETDNS_RETURN_INVALID_PARAMETER;
@@ -3941,9 +3942,9 @@ getdns_context_get_eventloop(getdns_context *context, getdns_eventloop **loop)
 	return GETDNS_RETURN_GOOD;
 }
 
-static size_t _getdns_get_appdata(getdns_context *context, char *path);
+static size_t _getdns_get_appdata(const getdns_context *context, char *path);
 static getdns_dict*
-_get_context_settings(getdns_context* context)
+_get_context_settings(const getdns_context* context)
 {
 	getdns_dict *result = getdns_dict_create_with_context(context);
 	getdns_list *list;
@@ -4155,7 +4156,7 @@ error:
 }
 
 getdns_dict*
-getdns_context_get_api_information(getdns_context* context)
+getdns_context_get_api_information(const getdns_context* context)
 {
 	getdns_dict* result;
 	getdns_dict* settings;
@@ -4350,197 +4351,117 @@ priv_getdns_context_mf(getdns_context *context)
 }
 
 /** begin getters **/
+
+#define CONTEXT_GETTER2(NAME,TYPE,VALUE) \
+    getdns_return_t \
+    getdns_context_get_ ## NAME ( \
+        const getdns_context *context, TYPE *value) \
+    { if (!context || !value)	return GETDNS_RETURN_INVALID_PARAMETER \
+    ; *value = context-> VALUE;	return GETDNS_RETURN_GOOD; }
+
+#define CONTEXT_GETTER(NAME,TYPE) CONTEXT_GETTER2(NAME,TYPE,NAME)
+
+CONTEXT_GETTER(resolution_type, getdns_resolution_t)
+
 getdns_return_t
-getdns_context_get_resolution_type(getdns_context *context,
-    getdns_resolution_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->resolution_type;
-    return GETDNS_RETURN_GOOD;
+getdns_context_get_namespaces(const getdns_context *context,
+    size_t* namespace_count, getdns_namespace_t **namespaces)
+{
+	if (!context || !namespace_count || !namespaces)
+		return GETDNS_RETURN_INVALID_PARAMETER;
+	*namespace_count = context->namespace_count;
+	if (!context->namespace_count) {
+		*namespaces = NULL;
+		return GETDNS_RETURN_GOOD;
+	}
+	// use normal malloc here so users can do normal free
+	*namespaces = malloc(
+	    context->namespace_count * sizeof(getdns_namespace_t));
+	memcpy(*namespaces, context->namespaces,
+	    context->namespace_count * sizeof(getdns_namespace_t));
+	return GETDNS_RETURN_GOOD;
 }
 
 getdns_return_t
-getdns_context_get_namespaces(getdns_context *context,
-    size_t* namespace_count, getdns_namespace_t **namespaces) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(namespace_count, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(namespaces, GETDNS_RETURN_INVALID_PARAMETER);
-    *namespace_count = context->namespace_count;
-    if (!context->namespace_count) {
-        *namespaces = NULL;
-        return GETDNS_RETURN_GOOD;
-    }
-    // use normal malloc here so users can do normal free
-    *namespaces = malloc(context->namespace_count * sizeof(getdns_namespace_t));
-    memcpy(*namespaces, context->namespaces,
-           context->namespace_count * sizeof(getdns_namespace_t));
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_dns_transport(getdns_context *context,
-    getdns_transport_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-	int count = context->dns_transport_count;
-	getdns_transport_list_t *transports = context->dns_transports;
-    if (!count)
-        return GETDNS_RETURN_WRONG_TYPE_REQUESTED;
-
-    /* Best effort mapping for backwards compatibility*/
-    if (transports[0] == GETDNS_TRANSPORT_UDP) {
-        if (count == 1) 
-            *value = GETDNS_TRANSPORT_UDP_ONLY;
-        else if (count == 2 && transports[1] == GETDNS_TRANSPORT_TCP)
-            *value = GETDNS_TRANSPORT_UDP_FIRST_AND_FALL_BACK_TO_TCP;
-        else
-            return GETDNS_RETURN_WRONG_TYPE_REQUESTED;
-    }
-    if (transports[0] == GETDNS_TRANSPORT_TCP) {
-        if (count == 1) 
-            *value = GETDNS_TRANSPORT_TCP_ONLY_KEEP_CONNECTIONS_OPEN;
-    }
-    if (transports[0] == GETDNS_TRANSPORT_TLS) {
-        if (count == 1) 
-            *value = GETDNS_TRANSPORT_TLS_ONLY_KEEP_CONNECTIONS_OPEN;
-        else if (count == 2 && transports[1] == GETDNS_TRANSPORT_TCP)
-            *value = GETDNS_TRANSPORT_TLS_FIRST_AND_FALL_BACK_TO_TCP_KEEP_CONNECTIONS_OPEN;
-        else
-            return GETDNS_RETURN_WRONG_TYPE_REQUESTED;
-    }
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_dns_transport_list(getdns_context *context,
-    size_t* transport_count, getdns_transport_list_t **transports) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(transport_count, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(transports, GETDNS_RETURN_INVALID_PARAMETER);
-   *transport_count = context->dns_transport_count;
-    if (!context->dns_transport_count) {
-        *transports = NULL;
-        return GETDNS_RETURN_GOOD;
-    }
-    // use normal malloc here so users can do normal free
-    *transports = malloc(context->dns_transport_count * sizeof(getdns_transport_list_t));
-    memcpy(*transports, context->dns_transports,
-           context->dns_transport_count * sizeof(getdns_transport_list_t));
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_tls_authentication(getdns_context *context,
-    getdns_tls_authentication_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->tls_auth;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_round_robin_upstreams(getdns_context *context,
-    uint8_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->round_robin_upstreams;
-    return GETDNS_RETURN_GOOD;
-}
-
-/**
- * Get the maximum number of messages that can be sent to other upstreams
- * before the upstream which has previously timed out will be tried again.
- * @see getdns_context_set_max_backoff_value
- * @param[in]  context  The context from which to get the setting
- * @param[out] value    Number of messages sent to other upstreams before 
- *                      retrying the upstream which had timed out.
- * @return GETDNS_RETURN_GOOD on success
- * @return GETDNS_RETURN_INVALID_PARAMETER if context is null.
- */
-getdns_return_t
-getdns_context_get_max_backoff_value(getdns_context *context,
-    uint16_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->max_backoff_value;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_tls_backoff_time(getdns_context *context,
-    uint16_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->tls_backoff_time;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_tls_connection_retries(getdns_context *context,
-    uint16_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->tls_connection_retries;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_limit_outstanding_queries(getdns_context *context,
-    uint16_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->limit_outstanding_queries;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_timeout(getdns_context *context, uint64_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->timeout;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_idle_timeout(getdns_context *context, uint64_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->idle_timeout;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_follow_redirects(
-    getdns_context *context, getdns_redirects_t* value)
+getdns_context_get_dns_transport(
+    const getdns_context *context, getdns_transport_t* value)
 {
 	if (!context || !value)
 		return GETDNS_RETURN_INVALID_PARAMETER;
-	*value = context->follow_redirects;
-	return GETDNS_RETURN_NOT_IMPLEMENTED;
+
+	if (context->dns_transport_count == 0)
+		return GETDNS_RETURN_WRONG_TYPE_REQUESTED;
+
+	/* Best effort mapping for backwards compatibility*/
+	if (context->dns_transports[0] == GETDNS_TRANSPORT_UDP) {
+		if (context->dns_transport_count == 1) 
+			*value = GETDNS_TRANSPORT_UDP_ONLY;
+		else if (context->dns_transport_count == 2
+		     &&  context->dns_transports[1] == GETDNS_TRANSPORT_TCP)
+			*value = GETDNS_TRANSPORT_UDP_FIRST_AND_FALL_BACK_TO_TCP;
+		else
+			return GETDNS_RETURN_WRONG_TYPE_REQUESTED;
+	}
+	if (context->dns_transports[0] == GETDNS_TRANSPORT_TCP) {
+		if (context->dns_transport_count == 1) 
+			*value = GETDNS_TRANSPORT_TCP_ONLY_KEEP_CONNECTIONS_OPEN;
+	}
+	if (context->dns_transports[0] == GETDNS_TRANSPORT_TLS) {
+		if (context->dns_transport_count == 1) 
+			*value = GETDNS_TRANSPORT_TLS_ONLY_KEEP_CONNECTIONS_OPEN;
+		else if (context->dns_transport_count == 2
+		     &&  context->dns_transports[1] == GETDNS_TRANSPORT_TCP)
+			*value = GETDNS_TRANSPORT_TLS_FIRST_AND_FALL_BACK_TO_TCP_KEEP_CONNECTIONS_OPEN;
+		else
+			return GETDNS_RETURN_WRONG_TYPE_REQUESTED;
+	}
+	return GETDNS_RETURN_GOOD;
 }
 
 getdns_return_t
-getdns_context_get_dns_root_servers(getdns_context *context,
-    getdns_list **value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = NULL;
-    if (context->dns_root_servers)
-        return _getdns_list_copy(context->dns_root_servers, value);
-    return GETDNS_RETURN_GOOD;
+getdns_context_get_dns_transport_list(const getdns_context *context,
+    size_t* transport_count, getdns_transport_list_t **transports)
+{
+	if (!context || !transport_count || !transports)
+		return GETDNS_RETURN_INVALID_PARAMETER;
+	*transport_count = context->dns_transport_count;
+	if (!context->dns_transport_count) {
+		*transports = NULL;
+		return GETDNS_RETURN_GOOD;
+	}
+	// use normal malloc here so users can do normal free
+	*transports = malloc(
+	    context->dns_transport_count * sizeof(getdns_transport_t));
+	memcpy(*transports, context->dns_transports,
+	    context->dns_transport_count * sizeof(getdns_transport_t));
+	return GETDNS_RETURN_GOOD;
 }
 
-getdns_return_t
-getdns_context_get_append_name(getdns_context *context,
-    getdns_append_name_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->append_name;
-    return GETDNS_RETURN_GOOD;
-}
+CONTEXT_GETTER2(tls_authentication, getdns_tls_authentication_t, tls_auth)
+CONTEXT_GETTER(round_robin_upstreams      , uint8_t)
+CONTEXT_GETTER(max_backoff_value          , uint16_t)
+CONTEXT_GETTER(tls_backoff_time           , uint16_t)
+CONTEXT_GETTER(tls_connection_retries     , uint16_t)
+CONTEXT_GETTER(limit_outstanding_queries  , uint16_t)
+CONTEXT_GETTER(timeout                    , uint64_t)
+CONTEXT_GETTER(idle_timeout               , uint64_t)
+CONTEXT_GETTER(follow_redirects           , getdns_redirects_t)
 
 getdns_return_t
-getdns_context_get_suffix(getdns_context *context, getdns_list **value)
+getdns_context_get_dns_root_servers(
+    const getdns_context *context, getdns_list **value)
+{
+	if (!context || !value) return GETDNS_RETURN_INVALID_PARAMETER;
+	if (context->dns_root_servers)
+		return _getdns_list_copy(context->dns_root_servers, value);
+	*value = NULL;
+	return GETDNS_RETURN_GOOD;
+}
+
+CONTEXT_GETTER(append_name                , getdns_append_name_t)
+
+getdns_return_t
+getdns_context_get_suffix(const getdns_context *context, getdns_list **value)
 {
 	size_t dname_len;
 	const uint8_t *dname;
@@ -4578,10 +4499,9 @@ getdns_context_get_suffix(getdns_context *context, getdns_list **value)
 
 getdns_return_t
 getdns_context_get_dnssec_trust_anchors(
-    getdns_context *context, getdns_list **value)
+    const getdns_context *context, getdns_list **value)
 {
-	RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-	RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
+	if (!context || !value) return GETDNS_RETURN_INVALID_PARAMETER;
 
 	if (context->trust_anchors) {
 		if ((*value = getdns_list_create_with_context(context)))
@@ -4597,17 +4517,17 @@ getdns_context_get_dnssec_trust_anchors(
 }
 
 getdns_return_t
-getdns_context_get_dnssec_allowed_skew(getdns_context *context,
-    uint32_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->dnssec_allowed_skew;
-    return GETDNS_RETURN_GOOD;
+getdns_context_get_dnssec_allowed_skew(
+    const getdns_context *context, uint32_t* value)
+{
+	if (!context || !value) return GETDNS_RETURN_INVALID_PARAMETER;
+	*value = context->dnssec_allowed_skew;
+	return GETDNS_RETURN_GOOD;
 }
 
 getdns_return_t
-getdns_context_get_upstream_recursive_servers(getdns_context *context,
-    getdns_list **upstreams_r)
+getdns_context_get_upstream_recursive_servers(
+    const getdns_context *context, getdns_list **upstreams_r)
 {
 	size_t i;
 	getdns_list *upstreams;
@@ -4733,55 +4653,20 @@ getdns_context_get_upstream_recursive_servers(getdns_context *context,
 }
 
 getdns_return_t
-getdns_context_get_edns_maximum_udp_payload_size(getdns_context *context,
-    uint16_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->edns_maximum_udp_payload_size == -1 ? 0
-           : context->edns_maximum_udp_payload_size;
-    return GETDNS_RETURN_GOOD;
+getdns_context_get_edns_maximum_udp_payload_size(
+    const getdns_context *context, uint16_t* value)
+{
+	if (!context || !value) return GETDNS_RETURN_INVALID_PARAMETER;
+	*value = context->edns_maximum_udp_payload_size == -1 ? 0
+	       : context->edns_maximum_udp_payload_size;
+	return GETDNS_RETURN_GOOD;
 }
 
-getdns_return_t
-getdns_context_get_edns_extended_rcode(getdns_context *context,
-    uint8_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->edns_extended_rcode;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_edns_version(getdns_context *context, uint8_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->edns_version;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_edns_do_bit(getdns_context *context, uint8_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->edns_do_bit;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_edns_client_subnet_private(getdns_context *context, uint8_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->edns_client_subnet_private;
-    return GETDNS_RETURN_GOOD;
-}
-
-getdns_return_t
-getdns_context_get_tls_query_padding_blocksize(getdns_context *context, uint16_t* value) {
-    RETURN_IF_NULL(context, GETDNS_RETURN_INVALID_PARAMETER);
-    RETURN_IF_NULL(value, GETDNS_RETURN_INVALID_PARAMETER);
-    *value = context->tls_query_padding_blocksize;
-    return GETDNS_RETURN_GOOD;
-}
+CONTEXT_GETTER(edns_extended_rcode        , uint8_t)
+CONTEXT_GETTER(edns_version               , uint8_t)
+CONTEXT_GETTER(edns_do_bit                , uint8_t)
+CONTEXT_GETTER(edns_client_subnet_private , uint8_t)
+CONTEXT_GETTER(tls_query_padding_blocksize, uint16_t)
 
 static int _streq(const getdns_bindata *name, const char *str)
 {
@@ -5043,7 +4928,7 @@ getdns_context_config(getdns_context *context, const getdns_dict *config_dict)
 	return r;
 }
 
-static size_t _getdns_get_appdata(getdns_context *context, char *path)
+static size_t _getdns_get_appdata(const getdns_context *context, char *path)
 {
 	size_t len = 0;
 
@@ -5116,7 +5001,8 @@ static size_t _getdns_get_appdata(getdns_context *context, char *path)
 	return 0;
 }
 
-FILE *_getdns_context_get_priv_fp(getdns_context *context, const char *fn)
+FILE *_getdns_context_get_priv_fp(
+    const getdns_context *context, const char *fn)
 {
 	char path[_GETDNS_PATH_MAX];
 	FILE *f = NULL;
@@ -5145,7 +5031,7 @@ FILE *_getdns_context_get_priv_fp(getdns_context *context, const char *fn)
 	return f;
 }
 
-uint8_t *_getdns_context_get_priv_file(getdns_context *context,
+uint8_t *_getdns_context_get_priv_file(const getdns_context *context,
     const char *fn, uint8_t *buf, size_t buf_len, size_t *file_sz)
 {
 	FILE *f = NULL;
@@ -5330,7 +5216,7 @@ getdns_context_set_trust_anchors_url(
 
 getdns_return_t
 getdns_context_get_trust_anchors_url(
-    getdns_context *context, const char **url)
+    const getdns_context *context, const char **url)
 {
 	if (!context || !url)
 		return GETDNS_RETURN_INVALID_PARAMETER;
@@ -5360,7 +5246,7 @@ getdns_context_set_trust_anchors_verify_CA(
 
 getdns_return_t
 getdns_context_get_trust_anchors_verify_CA(
-    getdns_context *context, const char **verify_CA)
+    const getdns_context *context, const char **verify_CA)
 {
 	if (!verify_CA)
 		return GETDNS_RETURN_INVALID_PARAMETER;
@@ -5390,7 +5276,7 @@ getdns_context_set_trust_anchors_verify_email(
 
 getdns_return_t
 getdns_context_get_trust_anchors_verify_email(
-    getdns_context *context, const char **verify_email)
+    const getdns_context *context, const char **verify_email)
 {
 	if (!verify_email)
 		return GETDNS_RETURN_INVALID_PARAMETER;
@@ -5416,16 +5302,7 @@ getdns_context_set_trust_anchors_backoff_time(
 	return GETDNS_RETURN_GOOD;
 }
 
-getdns_return_t
-getdns_context_get_trust_anchors_backoff_time(
-    getdns_context *context, uint64_t *backoff_time)
-{
-	if (!backoff_time)
-		return GETDNS_RETURN_INVALID_PARAMETER;
-
-	*backoff_time = context->trust_anchors_backoff_time;
-	return GETDNS_RETURN_GOOD;
-}
+CONTEXT_GETTER(trust_anchors_backoff_time , uint64_t)
 
 getdns_return_t
 getdns_context_set_appdata_dir(
@@ -5505,15 +5382,7 @@ getdns_context_set_tls_ca_path(getdns_context *context, const char *tls_ca_path)
 	return GETDNS_RETURN_GOOD;
 }
 
-getdns_return_t
-getdns_context_get_tls_ca_path(getdns_context *context, const char **tls_ca_path)
-{
-	if (!context || !tls_ca_path)
-		return GETDNS_RETURN_INVALID_PARAMETER;
-
-	*tls_ca_path = context->tls_ca_path;
-	return GETDNS_RETURN_GOOD;
-}
+CONTEXT_GETTER(tls_ca_path                , const char *)
 
 getdns_return_t
 getdns_context_set_tls_ca_file(getdns_context *context, const char *tls_ca_file)
@@ -5528,15 +5397,7 @@ getdns_context_set_tls_ca_file(getdns_context *context, const char *tls_ca_file)
 	return GETDNS_RETURN_GOOD;
 }
 
-getdns_return_t
-getdns_context_get_tls_ca_file(getdns_context *context, const char **tls_ca_file)
-{
-	if (!context || !tls_ca_file)
-		return GETDNS_RETURN_INVALID_PARAMETER;
-
-	*tls_ca_file = context->tls_ca_file;
-	return GETDNS_RETURN_GOOD;
-}
+CONTEXT_GETTER(tls_ca_file                , const char *)
 
 getdns_return_t
 getdns_context_set_tls_cipher_list(
@@ -5556,7 +5417,7 @@ getdns_context_set_tls_cipher_list(
 
 getdns_return_t
 getdns_context_get_tls_cipher_list(
-    getdns_context *context, const char **tls_cipher_list)
+    const getdns_context *context, const char **tls_cipher_list)
 {
 	if (!context || !tls_cipher_list)
 		return GETDNS_RETURN_INVALID_PARAMETER;
@@ -5585,7 +5446,7 @@ getdns_context_set_tls_ciphersuites(
 
 getdns_return_t
 getdns_context_get_tls_ciphersuites(
-    getdns_context *context, const char **tls_ciphersuites)
+    const getdns_context *context, const char **tls_ciphersuites)
 {
 	if (!context || !tls_ciphersuites)
 		return GETDNS_RETURN_INVALID_PARAMETER;
@@ -5617,15 +5478,7 @@ getdns_context_set_tls_curves_list(
 #endif
 }
 
-getdns_return_t
-getdns_context_get_tls_curves_list(
-    getdns_context *context, const char **tls_curves_list)
-{
-	if (!context || !tls_curves_list)
-		return GETDNS_RETURN_INVALID_PARAMETER;
-	*tls_curves_list = context->tls_curves_list;
-	return GETDNS_RETURN_GOOD;
-}
+CONTEXT_GETTER(tls_curves_list            , const char *)
 
 getdns_return_t
 getdns_context_set_tls_min_version(
@@ -5638,15 +5491,7 @@ getdns_context_set_tls_min_version(
 	return GETDNS_RETURN_GOOD;
 }
 
-getdns_return_t
-getdns_context_get_tls_min_version(
-    getdns_context *context, getdns_tls_version_t *tls_min_version)
-{
-	if (!context || !tls_min_version)
-		return GETDNS_RETURN_INVALID_PARAMETER;
-	*tls_min_version = context->tls_min_version;
-	return GETDNS_RETURN_GOOD;
-}
+CONTEXT_GETTER(tls_min_version            , getdns_tls_version_t)
 
 getdns_return_t
 getdns_context_set_tls_max_version(
@@ -5659,14 +5504,6 @@ getdns_context_set_tls_max_version(
 	return GETDNS_RETURN_GOOD;
 }
 
-getdns_return_t
-getdns_context_get_tls_max_version(
-    getdns_context *context, getdns_tls_version_t *tls_max_version)
-{
-	if (!context || !tls_max_version)
-		return GETDNS_RETURN_INVALID_PARAMETER;
-	*tls_max_version = context->tls_max_version;
-	return GETDNS_RETURN_GOOD;
-}
+CONTEXT_GETTER(tls_max_version            , getdns_tls_version_t)
 
 /* context.c */
diff --git a/src/context.h b/src/context.h
index bf3d7da6..72b9d9d2 100644
--- a/src/context.h
+++ b/src/context.h
@@ -590,8 +590,9 @@ void _getdns_upstreams_dereference(getdns_upstreams *upstreams);
 
 void _getdns_upstream_shutdown(getdns_upstream *upstream);
 
-FILE *_getdns_context_get_priv_fp(getdns_context *context, const char *fn);
-uint8_t *_getdns_context_get_priv_file(getdns_context *context,
+FILE *_getdns_context_get_priv_fp(
+    const getdns_context *context, const char *fn);
+uint8_t *_getdns_context_get_priv_file(const getdns_context *context,
     const char *fn, uint8_t *buf, size_t buf_len, size_t *file_sz);
 
 int _getdns_context_write_priv_file(getdns_context *context,
diff --git a/src/dict.c b/src/dict.c
index 02d3f20f..d2ce53a9 100644
--- a/src/dict.c
+++ b/src/dict.c
@@ -434,7 +434,7 @@ getdns_dict_create_with_memory_functions(void *(*malloc)(size_t),
 
 /*-------------------------- getdns_dict_create_with_context */
 struct getdns_dict *
-getdns_dict_create_with_context(struct getdns_context *context)
+getdns_dict_create_with_context(const getdns_context *context)
 {
 	if (context)
 		return getdns_dict_create_with_extended_memory_functions(
@@ -655,7 +655,8 @@ getdns_dict_set_bindata(
 
 /*---------------------------------------- getdns_dict_set_bindata */
 getdns_return_t
-getdns_dict_util_set_string(getdns_dict *dict, char *name, const char *value)
+getdns_dict_util_set_string(getdns_dict *dict,
+    const char *name, const char *value)
 {
 	getdns_item    *item;
 	getdns_bindata *newbindata;
diff --git a/src/dnssec.c b/src/dnssec.c
index 7fa8e0b1..0e318c7e 100644
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -523,7 +523,7 @@ static void val_chain_sched(chain_head *head, const uint8_t *dname);
 static void val_chain_sched_ds(chain_head *head, const uint8_t *dname);
 static void val_chain_sched_signer(chain_head *head, _getdns_rrsig_iter *rrsig);
 
-static chain_head *add_rrset2val_chain(struct mem_funcs *mf,
+static chain_head *add_rrset2val_chain(const struct mem_funcs *mf,
     chain_head **chain_p, _getdns_rrset *rrset, getdns_network_req *netreq)
 {
 	chain_head *head;
@@ -788,7 +788,7 @@ static int is_synthesized_cname(_getdns_rrset *cname)
  * When a SOA query was successful, a query for DS will follow for that
  * owner name.
  */
-static void add_pkt2val_chain(struct mem_funcs *mf,
+static void add_pkt2val_chain(const struct mem_funcs *mf,
     chain_head **chain_p, uint8_t *pkt, size_t pkt_len,
     getdns_network_req *netreq)
 {
@@ -850,7 +850,7 @@ static void add_pkt2val_chain(struct mem_funcs *mf,
  * checked eventually.
  * But only if we know the question of course...
  */
-static void add_question2val_chain(struct mem_funcs *mf,
+static void add_question2val_chain(const struct mem_funcs *mf,
     chain_head **chain_p, uint8_t *pkt, size_t pkt_len,
     const uint8_t *qname, uint16_t qtype, uint16_t qclass,
     getdns_network_req *netreq)
@@ -1364,8 +1364,9 @@ static int _rr_iter_rdata_cmp(const void *a, const void *b)
  * nc_name will be set to the next closer (within rrset->name).
  */
 #define VAL_RRSET_SPC_SZ 256
-static int _getdns_verify_rrsig(struct mem_funcs *mf,
-    _getdns_rrset *rrset, _getdns_rrsig_iter *rrsig, _getdns_rrtype_iter *key, const uint8_t **nc_name)
+static int _getdns_verify_rrsig(const struct mem_funcs *mf,
+    _getdns_rrset *rrset, _getdns_rrsig_iter *rrsig, _getdns_rrtype_iter *key,
+    const uint8_t **nc_name)
 {
 	int r;
 	int to_skip;
@@ -1683,8 +1684,9 @@ static int check_dates(time_t now, int32_t skew, int32_t exp, int32_t inc)
 /* Returns whether dnskey signed rrset.  If the rrset was a valid wildcard
  * expansion, nc_name will point to the next closer part of the name in rrset.
  */
-static int dnskey_signed_rrset(struct mem_funcs *mf, time_t now, uint32_t skew,
-    _getdns_rrtype_iter *dnskey, _getdns_rrset *rrset, const uint8_t **nc_name)
+static int dnskey_signed_rrset(const struct mem_funcs *mf, time_t now,
+    uint32_t skew, _getdns_rrtype_iter *dnskey, _getdns_rrset *rrset,
+    const uint8_t **nc_name)
 {
 	_getdns_rrsig_iter rrsig_spc, *rrsig;
 	_getdns_rdf_iter rdf_spc, *rdf;
@@ -1752,7 +1754,7 @@ static int dnskey_signed_rrset(struct mem_funcs *mf, time_t now, uint32_t skew,
 }
 
 /* Returns whether a dnskey for keyset signed a non wildcard rrset. */
-static int a_key_signed_rrset_no_wc(struct mem_funcs *mf, time_t now,
+static int a_key_signed_rrset_no_wc(const struct mem_funcs *mf, time_t now,
     uint32_t skew, _getdns_rrset *keyset, _getdns_rrset *rrset)
 {
 	_getdns_rrtype_iter dnskey_spc, *dnskey;
@@ -1780,13 +1782,13 @@ static int a_key_signed_rrset_no_wc(struct mem_funcs *mf, time_t now,
 	return 0;
 }
 
-static int find_nsec_covering_name(
-    struct mem_funcs *mf, time_t now, uint32_t skew, _getdns_rrset *dnskey,
+static int find_nsec_covering_name(const struct mem_funcs *mf,
+    time_t now, uint32_t skew, _getdns_rrset *dnskey,
     _getdns_rrset *rrset, const uint8_t *name, int *opt_out);
 
 /* Returns whether a dnskey for keyset signed rrset. */
-static int a_key_signed_rrset(struct mem_funcs *mf, time_t now, uint32_t skew,
-    _getdns_rrset *keyset, _getdns_rrset *rrset)
+static int a_key_signed_rrset(const struct mem_funcs *mf, time_t now,
+    uint32_t skew, _getdns_rrset *keyset, _getdns_rrset *rrset)
 {
 	_getdns_rrtype_iter dnskey_spc, *dnskey;
 	const uint8_t *nc_name; /* Initialized by dnskey_signed_rrset() */
@@ -1827,7 +1829,7 @@ static int a_key_signed_rrset(struct mem_funcs *mf, time_t now, uint32_t skew,
 /* Returns whether a DS in ds_set matches a dnskey in dnskey_set which in turn
  * signed the dnskey set.
  */
-static int ds_authenticates_keys(struct mem_funcs *mf,
+static int ds_authenticates_keys(const struct mem_funcs *mf,
     time_t now, uint32_t skew, _getdns_rrset *ds_set, _getdns_rrset *dnskey_set)
 {
 	_getdns_rrtype_iter dnskey_spc, *dnskey;
@@ -2112,8 +2114,8 @@ static int nsec3_covers_name(
 	}
 }
 
-static int find_nsec_covering_name(
-    struct mem_funcs *mf, time_t now, uint32_t skew, _getdns_rrset *dnskey,
+static int find_nsec_covering_name(const struct mem_funcs *mf, time_t now,
+    uint32_t skew, _getdns_rrset *dnskey,
     _getdns_rrset *rrset, const uint8_t *name, int *opt_out)
 {
 	_getdns_rrset_iter i_spc, *i;
@@ -2215,7 +2217,7 @@ static int find_nsec_covering_name(
 }
 
 static int nsec3_find_next_closer(
-    struct mem_funcs *mf, time_t now, uint32_t skew,
+    const struct mem_funcs *mf, time_t now, uint32_t skew,
     _getdns_rrset *dnskey, _getdns_rrset *rrset,
     const uint8_t *nc_name, int *opt_out)
 {
@@ -2267,7 +2269,7 @@ static int nsec3_find_next_closer(
  * verifying key: it returns keytag + NSEC3_ITERATION_COUNT_HIGH (0x20000)
  */
 static int key_proves_nonexistance(
-    struct mem_funcs *mf, time_t now, uint32_t skew,
+    const struct mem_funcs *mf, time_t now, uint32_t skew,
     _getdns_rrset *keyset, _getdns_rrset *rrset, int *opt_out)
 {
 	_getdns_rrset nsec_rrset, *cover, *ce;
@@ -2571,7 +2573,7 @@ static int key_proves_nonexistance(
  * non-existence of a DS along the path is proofed, and SECURE otherwise.
  */
 static int chain_node_get_trusted_keys(
-    struct mem_funcs *mf, time_t now, uint32_t skew,
+    const struct mem_funcs *mf, time_t now, uint32_t skew,
     chain_node *node, _getdns_rrset *ta, _getdns_rrset **keys)
 {
 	int s, keytag;
@@ -2714,7 +2716,7 @@ static int chain_node_get_trusted_keys(
  * For this first a secure keyset is looked up, with which the keyset is 
  * evaluated.
  */
-static int chain_head_validate_with_ta(struct mem_funcs *mf,
+static int chain_head_validate_with_ta(const struct mem_funcs *mf,
     time_t now, uint32_t skew, chain_head *head, _getdns_rrset *ta)
 {
 	_getdns_rrset *keys;
@@ -2801,8 +2803,8 @@ static int chain_head_validate_with_ta(struct mem_funcs *mf,
 /* The DNSSEC status of the rrset in head is evaluated by trying the trust
  * anchors in tas in turn.  The best outcome counts.
  */
-static int chain_head_validate(struct mem_funcs *mf, time_t now, uint32_t skew,
-    chain_head *head, _getdns_rrset_iter *tas)
+static int chain_head_validate(const struct mem_funcs *mf, time_t now,
+    uint32_t skew, chain_head *head, _getdns_rrset_iter *tas)
 {
 	_getdns_rrset_iter *i;
 	_getdns_rrset *ta, dnskey_ta, ds_ta;
@@ -2951,7 +2953,7 @@ static void chain_clear_netreq_dnssec_status(chain_head *chain)
  * processing each head in turn.  The worst outcome is the dnssec status for
  * the whole.
  */
-static int chain_validate_dnssec(struct mem_funcs *mf,
+static int chain_validate_dnssec(const struct mem_funcs *mf,
     time_t now, uint32_t skew, chain_head *chain, _getdns_rrset_iter *tas)
 {
 	int s = GETDNS_DNSSEC_INDETERMINATE, t;
@@ -3606,7 +3608,7 @@ void _getdns_get_validation_chain(getdns_dns_req *dnsreq)
  *****************************************************************************/
 
 
-static int wire_validate_dnssec(struct mem_funcs *mf,
+static int wire_validate_dnssec(const struct mem_funcs *mf,
     time_t now, uint32_t skew, uint8_t *to_val, size_t to_val_len,
     uint8_t *support, size_t support_len, uint8_t *tas, size_t tas_len)
 {
@@ -3688,9 +3690,9 @@ static int wire_validate_dnssec(struct mem_funcs *mf,
  *
  */
 getdns_return_t
-getdns_validate_dnssec2(getdns_list *records_to_validate,
-    getdns_list *support_records,
-    getdns_list *trust_anchors,
+getdns_validate_dnssec2(const getdns_list *records_to_validate,
+    const getdns_list *support_records,
+    const getdns_list *trust_anchors,
     time_t now, uint32_t skew)
 {
 	uint8_t to_val_buf[4096], *to_val,
@@ -3702,7 +3704,7 @@ getdns_validate_dnssec2(getdns_list *records_to_validate,
 	       tas_len = sizeof(tas_buf);
 
 	int r = GETDNS_RETURN_MEMORY_ERROR;
-	struct mem_funcs *mf;
+	const struct mem_funcs *mf;
 
 	size_t i;
 	getdns_dict *reply;
@@ -3783,9 +3785,9 @@ exit_free_support:
 
 
 getdns_return_t
-getdns_validate_dnssec(getdns_list *records_to_validate,
-    getdns_list *support_records,
-    getdns_list *trust_anchors)
+getdns_validate_dnssec(const getdns_list *records_to_validate,
+    const getdns_list *support_records,
+    const getdns_list *trust_anchors)
 {
 	return getdns_validate_dnssec2(records_to_validate, support_records,
 	    trust_anchors, time(NULL), 0);
diff --git a/src/getdns/getdns.h.in b/src/getdns/getdns.h.in
index aa7ae128..b3ef64e1 100644
--- a/src/getdns/getdns.h.in
+++ b/src/getdns/getdns.h.in
@@ -743,7 +743,7 @@ getdns_list *getdns_list_create();
  *                used to create and initialize the list.
  * @return pointer to an allocated list, NULL if insufficient memory
  */
-getdns_list *getdns_list_create_with_context(getdns_context *context);
+getdns_list *getdns_list_create_with_context(const getdns_context *context);
 
 /**
  * create a new list with no items, creating and initializing it with the
@@ -863,7 +863,7 @@ getdns_dict *getdns_dict_create();
  *                used to create and initialize the dict.
  * @return pointer to an allocated dict, NULL if insufficient memory
  */
-getdns_dict *getdns_dict_create_with_context(getdns_context *context);
+getdns_dict *getdns_dict_create_with_context(const getdns_context *context);
 
 /**
  * create a new dict with no items, creating and initializing it with the
@@ -1032,7 +1032,7 @@ getdns_general(getdns_context *context,
     uint16_t request_type,
     const getdns_dict *extensions,
     void *userarg,
-    getdns_transaction_t * transaction_id, getdns_callback_t callbackfn);
+    getdns_transaction_t *transaction_id, getdns_callback_t callbackfn);
 
 /**
  * retrieve address assigned to a DNS name
@@ -1050,7 +1050,7 @@ getdns_address(getdns_context *context,
     const char *name,
     const getdns_dict *extensions,
     void *userarg,
-    getdns_transaction_t * transaction_id, getdns_callback_t callbackfn);
+    getdns_transaction_t *transaction_id, getdns_callback_t callbackfn);
 
 /**
  * retrieve hostname assigned to an IP address
@@ -1068,7 +1068,7 @@ getdns_hostname(getdns_context *context,
     const getdns_dict *address,
     const getdns_dict *extensions,
     void *userarg,
-    getdns_transaction_t * transaction_id, getdns_callback_t callbackfn);
+    getdns_transaction_t *transaction_id, getdns_callback_t callbackfn);
 
 /**
  * retrieve a service assigned to a DNS name
@@ -1086,7 +1086,7 @@ getdns_service(getdns_context *context,
     const char *name,
     const getdns_dict *extensions,
     void *userarg,
-    getdns_transaction_t * transaction_id, getdns_callback_t callbackfn);
+    getdns_transaction_t *transaction_id, getdns_callback_t callbackfn);
 /** @}
  */
 
@@ -1341,9 +1341,8 @@ char *getdns_convert_alabel_to_ulabel(const char *alabel);
  * depending on the validation status.
  */
 getdns_return_t
-getdns_validate_dnssec(getdns_list *to_validate,
-    getdns_list *support_records,
-    getdns_list *trust_anchors);
+getdns_validate_dnssec(const getdns_list *to_validate,
+    const getdns_list *support_records, const getdns_list *trust_anchors);
 
 /**
  * Get the default list of trust anchor records that is used by the library
@@ -1816,7 +1815,7 @@ getdns_context_set_extended_memory_functions(getdns_context *context,
  *         object with getdns_dict_destroy.
  */
 getdns_dict*
-getdns_context_get_api_information(getdns_context* context);
+getdns_context_get_api_information(const getdns_context *context);
 
 /** @}
  */
diff --git a/src/getdns/getdns_extra.h.in b/src/getdns/getdns_extra.h.in
index 9b81f6c3..279abce0 100644
--- a/src/getdns/getdns_extra.h.in
+++ b/src/getdns/getdns_extra.h.in
@@ -361,7 +361,7 @@ struct getdns_eventloop_vmt {
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or eventloop were NULL.
  */
 getdns_return_t
-getdns_context_set_eventloop(getdns_context* context,
+getdns_context_set_eventloop(getdns_context *context,
     getdns_eventloop *eventloop);
 
 /**
@@ -377,7 +377,7 @@ getdns_context_set_eventloop(getdns_context* context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or evenloop were NULL
  */
 getdns_return_t
-getdns_context_get_eventloop(getdns_context* context,
+getdns_context_get_eventloop(const getdns_context *context,
     getdns_eventloop **eventloop);
 
 /**
@@ -850,7 +850,7 @@ getdns_context_set_tls_min_version(
  */
 getdns_return_t
 getdns_context_get_tls_min_version(
-    getdns_context *context, getdns_tls_version_t *min_version);
+    const getdns_context *context, getdns_tls_version_t *min_version);
 
 /**
  * Configure context for maximum supported TLS version.
@@ -880,7 +880,7 @@ getdns_context_set_tls_max_version(
  */
 getdns_return_t
 getdns_context_get_tls_max_version(
-    getdns_context *context, getdns_tls_version_t *max_version);
+    const getdns_context *context, getdns_tls_version_t *max_version);
 
 /**
  * Get the current resolution type setting from this context.
@@ -893,8 +893,8 @@ getdns_context_get_tls_max_version(
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_resolution_type(getdns_context *context,
-    getdns_resolution_t* value);
+getdns_context_get_resolution_type(const getdns_context *context,
+    getdns_resolution_t *value);
 
 /**
  * Get a copy of the namespaces list setting from this context.
@@ -908,8 +908,8 @@ getdns_context_get_resolution_type(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when any of the arguments was NULL.
  */
 getdns_return_t
-getdns_context_get_namespaces(getdns_context *context,
-    size_t* namespace_count, getdns_namespace_t **namespaces);
+getdns_context_get_namespaces(const getdns_context *context,
+    size_t *namespace_count, getdns_namespace_t **namespaces);
 
 /**
  * Get what transports are used for DNS lookups.
@@ -922,8 +922,8 @@ getdns_context_get_namespaces(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when any of the arguments was NULL.
  */
 getdns_return_t
-getdns_context_get_dns_transport(getdns_context *context,
-    getdns_transport_t* value);
+getdns_context_get_dns_transport(const getdns_context *context,
+    getdns_transport_t *value);
 
 /**
  * Get a copy of the transports list setting from this context.
@@ -938,8 +938,8 @@ getdns_context_get_dns_transport(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when any of the arguments was NULL.
  */
 getdns_return_t
-getdns_context_get_dns_transport_list(getdns_context *context,
-    size_t* transport_count, getdns_transport_list_t **transports);
+getdns_context_get_dns_transport_list(const getdns_context *context,
+    size_t *transport_count, getdns_transport_list_t **transports);
 
 /**
  * Get the current limit for outstanding queries setting from this context.
@@ -950,8 +950,8 @@ getdns_context_get_dns_transport_list(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or limit was NULL.
  */
 getdns_return_t
-getdns_context_get_limit_outstanding_queries(getdns_context *context,
-    uint16_t* limit);
+getdns_context_get_limit_outstanding_queries(const getdns_context *context,
+    uint16_t *limit);
 
 /**
  * Get the current number of milliseconds the API will wait for request
@@ -964,7 +964,7 @@ getdns_context_get_limit_outstanding_queries(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or limit was NULL.
  */
 getdns_return_t
-getdns_context_get_timeout(getdns_context *context, uint64_t* timeout);
+getdns_context_get_timeout(const getdns_context *context, uint64_t *timeout);
 
 /**
  * Get the current number of milliseconds the API will leave an idle TCP or TLS
@@ -978,7 +978,8 @@ getdns_context_get_timeout(getdns_context *context, uint64_t* timeout);
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or timeout was NULL.
  */
 getdns_return_t
-getdns_context_get_idle_timeout(getdns_context *context, uint64_t* timeout);
+getdns_context_get_idle_timeout(
+    const getdns_context *context, uint64_t *timeout);
 
 /**
  * Get the setting that says whether or not DNS queries follow redirects.
@@ -990,8 +991,8 @@ getdns_context_get_idle_timeout(getdns_context *context, uint64_t* timeout);
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_follow_redirects(getdns_context *context,
-    getdns_redirects_t* value);
+getdns_context_get_follow_redirects(const getdns_context *context,
+    getdns_redirects_t *value);
 
 /**
  * Get a copy of the list of addresses in use for looking up top-level domains
@@ -1008,7 +1009,7 @@ getdns_context_get_follow_redirects(getdns_context *context,
  * @return GETDNS_RETURN_MEMORY_ERROR when the copy could not be allocated
  */
 getdns_return_t
-getdns_context_get_dns_root_servers(getdns_context *context,
+getdns_context_get_dns_root_servers(const getdns_context *context,
     getdns_list **addresses);
 
 /**
@@ -1026,8 +1027,8 @@ getdns_context_get_dns_root_servers(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_append_name(getdns_context *context,
-    getdns_append_name_t* value);
+getdns_context_get_append_name(const getdns_context *context,
+    getdns_append_name_t *value);
 
 /**
  * Get a copy of the list of suffixes to be appended based on the value off the 
@@ -1043,7 +1044,7 @@ getdns_context_get_append_name(getdns_context *context,
  * @return GETDNS_RETURN_MEMORY_ERROR when the copy could not be allocated
  */
 getdns_return_t
-getdns_context_get_suffix(getdns_context *context, getdns_list **value);
+getdns_context_get_suffix(const getdns_context *context, getdns_list **value);
 
 /**
  * Get a copy of the list of DNSSEC trust anchors in use by context.
@@ -1058,7 +1059,7 @@ getdns_context_get_suffix(getdns_context *context, getdns_list **value);
  * @return GETDNS_RETURN_MEMORY_ERROR when the copy could not be allocated
  */
 getdns_return_t
-getdns_context_get_dnssec_trust_anchors(getdns_context *context,
+getdns_context_get_dnssec_trust_anchors(const getdns_context *context,
     getdns_list **value);
 
 /**
@@ -1072,8 +1073,8 @@ getdns_context_get_dnssec_trust_anchors(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_dnssec_allowed_skew(getdns_context *context,
-    uint32_t* value);
+getdns_context_get_dnssec_allowed_skew(const getdns_context *context,
+    uint32_t *value);
 
 /**
  * Get a copy of the list of upstream that will be targeted in stub resolution
@@ -1089,7 +1090,7 @@ getdns_context_get_dnssec_allowed_skew(getdns_context *context,
  * @return GETDNS_RETURN_MEMORY_ERROR when the copy could not be allocated
  */
 getdns_return_t
-getdns_context_get_upstream_recursive_servers(getdns_context *context,
+getdns_context_get_upstream_recursive_servers(const getdns_context *context,
     getdns_list **upstream_list);
 
 /**
@@ -1104,8 +1105,8 @@ getdns_context_get_upstream_recursive_servers(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_edns_maximum_udp_payload_size(getdns_context *context,
-    uint16_t* value);
+getdns_context_get_edns_maximum_udp_payload_size(const getdns_context *context,
+    uint16_t *value);
 
 /**
  * Get the rcode advertised in an EDNS0 OPT record setting from context
@@ -1116,8 +1117,8 @@ getdns_context_get_edns_maximum_udp_payload_size(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_edns_extended_rcode(getdns_context *context,
-    uint8_t* value);
+getdns_context_get_edns_extended_rcode(const getdns_context *context,
+    uint8_t *value);
 
 /**
  * Get the version advertised in an EDNS0 OPT record setting from context
@@ -1128,7 +1129,7 @@ getdns_context_get_edns_extended_rcode(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_edns_version(getdns_context *context, uint8_t* value);
+getdns_context_get_edns_version(const getdns_context *context, uint8_t *value);
 
 /**
  * Get the DO bit advertised in an EDNS0 OPT record setting from context
@@ -1140,7 +1141,7 @@ getdns_context_get_edns_version(getdns_context *context, uint8_t* value);
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_edns_do_bit(getdns_context *context, uint8_t* value);
+getdns_context_get_edns_do_bit(const getdns_context *context, uint8_t *value);
 
 /**
  * Get whether queries with this context will have the EDNS Client Subnet 
@@ -1153,7 +1154,8 @@ getdns_context_get_edns_do_bit(getdns_context *context, uint8_t* value);
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_edns_client_subnet_private(getdns_context *context, uint8_t* value);
+getdns_context_get_edns_client_subnet_private(const getdns_context *context,
+    uint8_t *value);
 
 /**
  * Get the blocksize that will be used to pad outgoing queries over TLS.
@@ -1165,7 +1167,8 @@ getdns_context_get_edns_client_subnet_private(getdns_context *context, uint8_t*
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_tls_query_padding_blocksize(getdns_context *context, uint16_t* value);
+getdns_context_get_tls_query_padding_blocksize(
+    const getdns_context *context, uint16_t *value);
 
 /**
  * Get whether the upstream needs to be authenticated with DNS over TLS.
@@ -1183,8 +1186,8 @@ getdns_context_get_tls_query_padding_blocksize(getdns_context *context, uint16_t
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_tls_authentication(getdns_context *context,
-    getdns_tls_authentication_t* value);
+getdns_context_get_tls_authentication(const getdns_context *context,
+    getdns_tls_authentication_t *value);
 
 /**
  * Get whether the context is configured to round robin queries over the available
@@ -1196,8 +1199,8 @@ getdns_context_get_tls_authentication(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_round_robin_upstreams(getdns_context *context,
-    uint8_t* value);
+getdns_context_get_round_robin_upstreams(const getdns_context *context,
+    uint8_t *value);
 
 /**
  * Get the amount of seconds a TLS connection should not be tried with
@@ -1211,8 +1214,8 @@ getdns_context_get_round_robin_upstreams(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_tls_backoff_time(getdns_context *context,
-    uint16_t* value);
+getdns_context_get_tls_backoff_time(const getdns_context *context,
+    uint16_t *value);
 
 /**
  * Get the number of times getdns retries to setup DNS over TLS with a
@@ -1226,8 +1229,8 @@ getdns_context_get_tls_backoff_time(getdns_context *context,
  * @return GETDNS_RETURN_INVALID_PARAMETER when context or value was NULL.
  */
 getdns_return_t
-getdns_context_get_tls_connection_retries(getdns_context *context,
-    uint16_t* value);
+getdns_context_get_tls_connection_retries(const getdns_context *context,
+    uint16_t *value);
 
 /**
  * Get the currently registered callback function and user defined argument
@@ -1244,7 +1247,8 @@ getdns_context_get_tls_connection_retries(getdns_context *context,
  * @return GETDNS_RETURN_GOOD on success or an error code on failure.
  */
 getdns_return_t
-getdns_context_get_update_callback(getdns_context *context, void **userarg,
+getdns_context_get_update_callback(const getdns_context *context,
+    void **userarg,
     void (**value) (getdns_context *, getdns_context_code_t, void *));
 
 
@@ -1298,7 +1302,7 @@ getdns_context_get_update_callback(getdns_context *context, void **userarg,
  */
 getdns_return_t
 getdns_context_get_trust_anchors_url(
-    getdns_context *context, const char **url);
+    const getdns_context *context, const char **url);
 
 /**
  * Gets the public certificate for the Certificate Authority with which to
@@ -1317,7 +1321,7 @@ getdns_context_get_trust_anchors_url(
  */
 getdns_return_t
 getdns_context_get_trust_anchors_verify_CA(
-    getdns_context *context, const char **verify_CA);
+    const getdns_context *context, const char **verify_CA);
 
 /**
  * Gets the email address for the Subject of the signer's certificate from the
@@ -1334,7 +1338,7 @@ getdns_context_get_trust_anchors_verify_CA(
  */
 getdns_return_t
 getdns_context_get_trust_anchors_verify_email(
-    getdns_context *context, const char **verify_email);
+    const getdns_context *context, const char **verify_email);
 
 /**
  * Get the amount of milliseconds the trust anchors will not be tried to be
@@ -1348,7 +1352,7 @@ getdns_context_get_trust_anchors_verify_email(
  */
 getdns_return_t
 getdns_context_get_trust_anchors_backoff_time(
-    getdns_context *context, uint64_t *value);
+    const getdns_context *context, uint64_t *value);
 
 /**
  * Get the value with which the context's upstream recursive servers
@@ -1361,7 +1365,8 @@ getdns_context_get_trust_anchors_backoff_time(
  * @return GETDNS_RETURN_GOOD when successful and error code otherwise.
  */
 getdns_return_t
-getdns_context_get_resolvconf(getdns_context *context, const char **resolvconf);
+getdns_context_get_resolvconf(
+    const getdns_context *context, const char **resolvconf);
 
 /**
  * Get the value with which the context's GETDNS_NAMESPACE_LOCALNAMES namespace 
@@ -1374,7 +1379,8 @@ getdns_context_get_resolvconf(getdns_context *context, const char **resolvconf);
  * @return GETDNS_RETURN_GOOD when successful and error code otherwise.
  */
 getdns_return_t
-getdns_context_get_hosts(getdns_context *context, const char **hosts);
+getdns_context_get_hosts(
+    const getdns_context *context, const char **hosts);
 
 /**
  * Get the location of the directory for CA certificates for verification
@@ -1388,7 +1394,8 @@ getdns_context_get_hosts(getdns_context *context, const char **hosts);
  * @return GETDNS_RETURN_INVALID_PARAMETER when context was NULL.
  */
 getdns_return_t
-getdns_context_get_tls_ca_path(getdns_context *context, const char **tls_ca_path);
+getdns_context_get_tls_ca_path(
+    const getdns_context *context, const char **tls_ca_path);
 
 /**
  * Get the file location with CA certificates for verification purposes.
@@ -1401,7 +1408,8 @@ getdns_context_get_tls_ca_path(getdns_context *context, const char **tls_ca_path
  * @return GETDNS_RETURN_INVALID_PARAMETER when context was NULL.
  */
 getdns_return_t
-getdns_context_get_tls_ca_file(getdns_context *context, const char **tls_ca_file);
+getdns_context_get_tls_ca_file(
+    const getdns_context *context, const char **tls_ca_file);
 
 /**
  * Get the list of available ciphers for authenticated TLS upstreams.
@@ -1413,7 +1421,7 @@ getdns_context_get_tls_ca_file(getdns_context *context, const char **tls_ca_file
  */
 getdns_return_t
 getdns_context_get_tls_cipher_list(
-    getdns_context *context, const char **cipher_list);
+    const getdns_context *context, const char **cipher_list);
 
 /**
  * Get the configured available TLS1.3 ciphersuited for authenticated TLS 
@@ -1426,7 +1434,7 @@ getdns_context_get_tls_cipher_list(
  */
 getdns_return_t
 getdns_context_get_tls_ciphersuites(
-    getdns_context *context, const char **ciphersuites);
+    const getdns_context *context, const char **ciphersuites);
 
 /**
  * Get the supported curves list if one has been set earlier.
@@ -1441,7 +1449,7 @@ getdns_context_get_tls_ciphersuites(
  */
 getdns_return_t
 getdns_context_get_tls_curves_list(
-    getdns_context *context, const char **curves_list);
+    const getdns_context *context, const char **curves_list);
 
 /** @}
  */
@@ -1529,7 +1537,8 @@ const char *getdns_get_errorstr_by_id(uint16_t err);
  * @return GETDNS_RETURN_MEMORY_ERROR when the copy could not be allocated
  */
 getdns_return_t
-getdns_dict_util_set_string(getdns_dict *dict, char *name, const char *value);
+getdns_dict_util_set_string(
+    getdns_dict *dict, const char *name, const char *value);
 
 /**
  * Get the string associated with the speicifed name.  The string should not
@@ -1542,7 +1551,8 @@ getdns_dict_util_set_string(getdns_dict *dict, char *name, const char *value);
  * @return GETDNS_RETURN_NO_SUCH_DICT_NAME if dict is invalid or name does not exist
  */
 getdns_return_t
-getdns_dict_util_get_string(getdns_dict * dict, char *name, char **result);
+getdns_dict_util_get_string(
+    const getdns_dict * dict, const char *name, char **result);
 
 /** @}
  */
@@ -1583,9 +1593,9 @@ getdns_dict_util_get_string(getdns_dict * dict, char *name, char **result);
  *         return code.
  */
 getdns_return_t
-getdns_validate_dnssec2(getdns_list *to_validate,
-    getdns_list *support_records,
-    getdns_list *trust_anchors,
+getdns_validate_dnssec2(const getdns_list *to_validate,
+    const getdns_list *support_records,
+    const getdns_list *trust_anchors,
     time_t validation_time, uint32_t skew);
 
 
@@ -1628,9 +1638,9 @@ getdns_validate_dnssec2(getdns_list *to_validate,
  * @param str the pinning string to parse
  * @return a dict created from ctx, or  NULL if the string did not match. 
  */
-getdns_dict* getdns_pubkey_pin_create_from_string(
-	getdns_context* context,
-	const char* str);
+getdns_dict *getdns_pubkey_pin_create_from_string(
+	const getdns_context *context,
+	const char *str);
 
 
 /**
@@ -1647,8 +1657,8 @@ getdns_dict* getdns_pubkey_pin_create_from_string(
  * @return GETDNS_RETURN_GOOD if the pinset passes the sanity check.
  */ 
 getdns_return_t getdns_pubkey_pinset_sanity_check(
-	const getdns_list* pinset,
-	getdns_list* errorlist);
+	const getdns_list *pinset,
+	getdns_list *errorlist);
 
 /** @}
  */
@@ -2296,7 +2306,7 @@ getdns_context_set_listen_addresses(
  */
 getdns_return_t
 getdns_reply(getdns_context *context,
-    getdns_dict *reply, getdns_transaction_t request_id);
+    const getdns_dict *reply, getdns_transaction_t request_id);
 
 
 /** @}
@@ -2320,7 +2330,7 @@ getdns_return_t getdns_strerror(getdns_return_t err, char *buf, size_t buflen);
  * WARNING! Do not use this function.  This function will be removed in
  * future versions of getdns.
  */
-getdns_return_t getdns_context_process_async(getdns_context* context);
+getdns_return_t getdns_context_process_async(getdns_context *context);
 
 /**
  * Return the number of pending requests and the point of time of the next
@@ -2328,8 +2338,8 @@ getdns_return_t getdns_context_process_async(getdns_context* context);
  * WARNING! Do not use this function.  This function will be removed in
  * future versions of getdns.
  */
-uint32_t getdns_context_get_num_pending_requests(getdns_context* context,
-    struct timeval* next_timeout);
+uint32_t getdns_context_get_num_pending_requests(const getdns_context *context,
+    struct timeval *next_timeout);
 
 /**
  * Detach the eventloop from the context.  Resets the context with the default
@@ -2354,7 +2364,7 @@ getdns_context_detach_eventloop(getdns_context *context);
  * @return GETDNS_RETURN_GOOD on success
  * @return GETDNS_RETURN_INVALID_PARAMETER if context is NULL
  */
-getdns_return_t getdns_context_set_use_threads(getdns_context* context,
+getdns_return_t getdns_context_set_use_threads(getdns_context *context,
     int use_threads);
 
 /** @}
diff --git a/src/list.c b/src/list.c
index c7bd476b..555a847f 100644
--- a/src/list.c
+++ b/src/list.c
@@ -418,7 +418,7 @@ getdns_list_create_with_memory_functions(void *(*malloc)(size_t),
 
 /*-------------------------- getdns_list_create_with_context */
 struct getdns_list *
-getdns_list_create_with_context(struct getdns_context *context)
+getdns_list_create_with_context(const getdns_context *context)
 {
 	if (context)
 		return getdns_list_create_with_extended_memory_functions(
diff --git a/src/pubkey-pinning.c b/src/pubkey-pinning.c
index 9edcb71b..e7aae2f7 100644
--- a/src/pubkey-pinning.c
+++ b/src/pubkey-pinning.c
@@ -93,16 +93,15 @@ static const getdns_bindata sha256 = {
    It is the caller's responsibility to call getdns_dict_destroy when
    it is no longer needed.
  */
-getdns_dict* getdns_pubkey_pin_create_from_string(
-	getdns_context* context,
-	const char* str)
+getdns_dict *getdns_pubkey_pin_create_from_string(
+   const getdns_context *context, const char *str)
 {
 	BIO *bio = NULL;
 	size_t i;
 	uint8_t buf[SHA256_DIGEST_LENGTH];
 	char inbuf[B64_ENCODED_SHA256_LENGTH + 1];
 	getdns_bindata value = { .size = SHA256_DIGEST_LENGTH, .data = buf };
-	getdns_dict* out = NULL;
+	getdns_dict *out = NULL;
 	
 	/* we only do sha256 right now, make sure this is well-formed */
 	if (!str || strncmp(PIN_PREFIX, str, PIN_PREFIX_LENGTH))
@@ -271,7 +270,7 @@ _getdns_get_pubkey_pinset_from_list(const getdns_list *pinset_list,
 }
 
 getdns_return_t
-_getdns_get_pubkey_pinset_list(getdns_context *ctx,
+_getdns_get_pubkey_pinset_list(const getdns_context *ctx,
 			       const sha256_pin_t *pinset_in,
 			       getdns_list **pinset_list)
 {
diff --git a/src/pubkey-pinning.h b/src/pubkey-pinning.h
index 8a09b2f3..a17ecb61 100644
--- a/src/pubkey-pinning.h
+++ b/src/pubkey-pinning.h
@@ -44,7 +44,7 @@ _getdns_get_pubkey_pinset_from_list(const getdns_list *pinset_list,
 
 /* create a getdns_list version of the pinset */
 getdns_return_t
-_getdns_get_pubkey_pinset_list(getdns_context *ctx,
+_getdns_get_pubkey_pinset_list(const getdns_context *ctx,
 			       const sha256_pin_t *pinset_in,
 			       getdns_list **pinset_list);
 
diff --git a/src/server.c b/src/server.c
index a6d4008e..3736a6f2 100644
--- a/src/server.c
+++ b/src/server.c
@@ -287,8 +287,8 @@ _getdns_cancel_reply(getdns_context *context, connection *conn)
 }
 
 getdns_return_t
-getdns_reply(
-    getdns_context *context, getdns_dict *reply, getdns_transaction_t request_id)
+getdns_reply(getdns_context *context,
+    const getdns_dict *reply, getdns_transaction_t request_id)
 {
 	/* TODO: Check request_id at context->outbound_requests */
 	connection *conn = (connection *)(intptr_t)request_id;
diff --git a/src/util-internal.c b/src/util-internal.c
index 0eaf3435..45fd2fda 100644
--- a/src/util-internal.c
+++ b/src/util-internal.c
@@ -54,7 +54,8 @@
 
 
 getdns_return_t
-getdns_dict_util_get_string(getdns_dict * dict, char *name, char **result)
+getdns_dict_util_get_string(const getdns_dict *dict,
+    const char *name, char **result)
 {
 	struct getdns_bindata *bindata = NULL;
 	if (!result) {
@@ -1454,7 +1455,7 @@ _getdns_validate_dname(const char* dname) {
 } /* _getdns_validate_dname */
 
 
-static void _getdns_reply2wire_buf(gldns_buffer *buf, getdns_dict *reply)
+static void _getdns_reply2wire_buf(gldns_buffer *buf, const getdns_dict *reply)
 {
 	getdns_dict *rr_dict, *q_dict, *h_dict;
 	getdns_list *section;
@@ -1510,7 +1511,7 @@ static void _getdns_reply2wire_buf(gldns_buffer *buf, getdns_dict *reply)
 	}
 }
 
-static void _getdns_list2wire_buf(gldns_buffer *buf, getdns_list *l)
+static void _getdns_list2wire_buf(gldns_buffer *buf, const getdns_list *l)
 {
 	getdns_dict *rr_dict;
 	size_t i, pkt_start;
@@ -1548,8 +1549,8 @@ static void _getdns_list2wire_buf(gldns_buffer *buf, getdns_list *l)
 	gldns_buffer_write_u16_at(buf, pkt_start+GLDNS_ANCOUNT_OFF, ancount);
 }
 
-uint8_t *_getdns_list2wire(
-    getdns_list *l, uint8_t *buf, size_t *buf_len, struct mem_funcs *mf)
+uint8_t *_getdns_list2wire(const getdns_list *l,
+    uint8_t *buf, size_t *buf_len, const struct mem_funcs *mf)
 {
 	gldns_buffer gbuf;
 	size_t sz;
@@ -1569,8 +1570,8 @@ uint8_t *_getdns_list2wire(
 	return buf;
 }
 
-uint8_t *_getdns_reply2wire(
-    getdns_dict *r, uint8_t *buf, size_t *buf_len, struct mem_funcs *mf)
+uint8_t *_getdns_reply2wire(const getdns_dict *r,
+    uint8_t *buf, size_t *buf_len, const struct mem_funcs *mf)
 {
 	gldns_buffer gbuf;
 	size_t sz;
@@ -1590,7 +1591,7 @@ uint8_t *_getdns_reply2wire(
 	return buf;
 }
 
-void _getdns_wire2list(uint8_t *pkt, size_t pkt_len, getdns_list *l)
+void _getdns_wire2list(const uint8_t *pkt, size_t pkt_len, getdns_list *l)
 {
 	_getdns_rr_iter rr_spc, *rr;
 	getdns_dict *rr_dict;
diff --git a/src/util-internal.h b/src/util-internal.h
index 4d5fbf56..d512a9d2 100644
--- a/src/util-internal.h
+++ b/src/util-internal.h
@@ -147,17 +147,18 @@ _getdns_rr_iter2rr_dict_canonical(
     struct mem_funcs *mf, _getdns_rr_iter *i, uint32_t *orig_ttl);
 
 struct getdns_dns_req;
-struct getdns_dict *_getdns_create_getdns_response(struct getdns_dns_req *completed_request);
+struct getdns_dict *_getdns_create_getdns_response(
+    struct getdns_dns_req *completed_request);
 
 getdns_return_t _getdns_validate_dname(const char* dname);
 
-uint8_t *_getdns_list2wire(
-    getdns_list *l, uint8_t *buf, size_t *buf_len, struct mem_funcs *mf);
+uint8_t *_getdns_list2wire(const getdns_list *l,
+    uint8_t *buf, size_t *buf_len, const struct mem_funcs *mf);
 
-uint8_t *_getdns_reply2wire(
-    getdns_dict *r, uint8_t *buf, size_t *buf_len, struct mem_funcs *mf);
+uint8_t *_getdns_reply2wire(const getdns_dict *r,
+    uint8_t *buf, size_t *buf_len, const struct mem_funcs *mf);
 
-void _getdns_wire2list(uint8_t *pkt, size_t pkt_len, getdns_list *l);
+void _getdns_wire2list(const uint8_t *pkt, size_t pkt_len, getdns_list *l);
 
 
 /**