diff --git a/secure/lib/libssh/Makefile b/secure/lib/libssh/Makefile
--- a/secure/lib/libssh/Makefile
+++ b/secure/lib/libssh/Makefile
@@ -45,7 +45,7 @@
 SRCS+=	getrrsetbyname.c
 .else
 LDNSDIR=	${SRCTOP}/contrib/ldns
-CFLAGS+=	-DHAVE_LDNS=1 -I${LDNSDIR}
+CFLAGS+=	-I${LDNSDIR}
 SRCS+=	getrrsetbyname-ldns.c
 LIBADD+=	ldns
 .endif
diff --git a/secure/libexec/sftp-server/Makefile b/secure/libexec/sftp-server/Makefile
--- a/secure/libexec/sftp-server/Makefile
+++ b/secure/libexec/sftp-server/Makefile
@@ -7,12 +7,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
diff --git a/secure/libexec/ssh-keysign/Makefile b/secure/libexec/ssh-keysign/Makefile
--- a/secure/libexec/ssh-keysign/Makefile
+++ b/secure/libexec/ssh-keysign/Makefile
@@ -6,15 +6,7 @@
 MAN=	ssh-keysign.8
 BINMODE=4555
 
-LIBADD=	ssh
-
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
-LIBADD+=	crypto
+LIBADD=	crypto ssh
 
 .include <bsd.prog.mk>
 
diff --git a/secure/libexec/ssh-pkcs11-helper/Makefile b/secure/libexec/ssh-pkcs11-helper/Makefile
--- a/secure/libexec/ssh-pkcs11-helper/Makefile
+++ b/secure/libexec/ssh-pkcs11-helper/Makefile
@@ -5,15 +5,7 @@
 SRCS=	ssh-pkcs11.c ssh-pkcs11-helper.c
 MAN=	ssh-pkcs11-helper.8
 
-LIBADD=	ssh
-
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
-LIBADD+=	crypto
+LIBADD=	crypto ssh
 
 .include <bsd.prog.mk>
 
diff --git a/secure/libexec/sshd-session/Makefile b/secure/libexec/sshd-session/Makefile
--- a/secure/libexec/sshd-session/Makefile
+++ b/secure/libexec/sshd-session/Makefile
@@ -26,12 +26,6 @@
 # pam should always happen before ssh here for static linking
 LIBADD=	pam ssh util
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .if ${MK_AUDIT} != "no"
 CFLAGS+= -DUSE_BSM_AUDIT=1 -DHAVE_GETAUDIT_ADDR=1
 LIBADD+=	bsm
diff --git a/secure/ssh.mk b/secure/ssh.mk
--- a/secure/ssh.mk
+++ b/secure/ssh.mk
@@ -12,6 +12,14 @@
 
 CFLAGS+= -DXAUTH_PATH=\"${LOCALBASE:U/usr/local}/bin/xauth\"
 
+.if ${MK_LDNS} != "no"
+CFLAGS+= -DHAVE_LDNS=1
+.endif
+
+.if ${MK_TCP_WRAPPERS} != "no"
+CFLAGS+= -DLIBWRAP=1
+.endif
+
 .if ${MK_USB} != "no"
 # Built-in security key support
 CFLAGS+= -include sk_config.h
diff --git a/secure/usr.bin/scp/Makefile b/secure/usr.bin/scp/Makefile
--- a/secure/usr.bin/scp/Makefile
+++ b/secure/usr.bin/scp/Makefile
@@ -7,12 +7,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
diff --git a/secure/usr.bin/sftp/Makefile b/secure/usr.bin/sftp/Makefile
--- a/secure/usr.bin/sftp/Makefile
+++ b/secure/usr.bin/sftp/Makefile
@@ -8,12 +8,6 @@
 
 LIBADD=	ssh edit
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
diff --git a/secure/usr.bin/ssh-add/Makefile b/secure/usr.bin/ssh-add/Makefile
--- a/secure/usr.bin/ssh-add/Makefile
+++ b/secure/usr.bin/ssh-add/Makefile
@@ -7,12 +7,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
diff --git a/secure/usr.bin/ssh-agent/Makefile b/secure/usr.bin/ssh-agent/Makefile
--- a/secure/usr.bin/ssh-agent/Makefile
+++ b/secure/usr.bin/ssh-agent/Makefile
@@ -5,20 +5,12 @@
 SRCS=	ssh-agent.c ssh-pkcs11-client.c
 PACKAGE=	ssh
 
-LIBADD=	ssh
-
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
+LIBADD=	crypto ssh
 
 .if defined(LOCALBASE)
 CFLAGS+= -DDEFAULT_PKCS11_WHITELIST='"/usr/lib*/*,${LOCALBASE}/lib*/*"'
 .endif
 
-LIBADD+=	crypto
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
diff --git a/secure/usr.bin/ssh-keygen/Makefile b/secure/usr.bin/ssh-keygen/Makefile
--- a/secure/usr.bin/ssh-keygen/Makefile
+++ b/secure/usr.bin/ssh-keygen/Makefile
@@ -6,13 +6,7 @@
 SRCS=	ssh-keygen.c sshsig.c ssh-sk-client.c
 PACKAGE=	ssh
 
-LIBADD=	ssh
-
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-.endif
-
-LIBADD+=	crypto
+LIBADD=	crypto ssh
 
 .include <bsd.prog.mk>
 
diff --git a/secure/usr.bin/ssh-keyscan/Makefile b/secure/usr.bin/ssh-keyscan/Makefile
--- a/secure/usr.bin/ssh-keyscan/Makefile
+++ b/secure/usr.bin/ssh-keyscan/Makefile
@@ -7,12 +7,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
diff --git a/secure/usr.bin/ssh/Makefile b/secure/usr.bin/ssh/Makefile
--- a/secure/usr.bin/ssh/Makefile
+++ b/secure/usr.bin/ssh/Makefile
@@ -17,10 +17,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-.endif
-
 .if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
 LIBADD+=	gssapi
 .endif
diff --git a/secure/usr.sbin/sshd/Makefile b/secure/usr.sbin/sshd/Makefile
--- a/secure/usr.sbin/sshd/Makefile
+++ b/secure/usr.sbin/sshd/Makefile
@@ -21,7 +21,6 @@
 .endif
 
 .if ${MK_TCP_WRAPPERS} != "no"
-CFLAGS+=	-DLIBWRAP=1
 LIBADD+=	wrap
 .endif