Index: secure/lib/libssh/Makefile
===================================================================
--- secure/lib/libssh/Makefile
+++ secure/lib/libssh/Makefile
@@ -46,7 +46,7 @@
 SRCS+=	getrrsetbyname.c
 .else
 LDNSDIR=	${SRCTOP}/contrib/ldns
-CFLAGS+=	-DHAVE_LDNS=1 -I${LDNSDIR}
+CFLAGS+=	-I${LDNSDIR}
 SRCS+=	getrrsetbyname-ldns.c
 LIBADD+=	ldns
 .endif
Index: secure/libexec/sftp-server/Makefile
===================================================================
--- secure/libexec/sftp-server/Makefile
+++ secure/libexec/sftp-server/Makefile
@@ -9,12 +9,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
Index: secure/libexec/ssh-keysign/Makefile
===================================================================
--- secure/libexec/ssh-keysign/Makefile
+++ secure/libexec/ssh-keysign/Makefile
@@ -8,15 +8,7 @@
 MAN=	ssh-keysign.8
 BINMODE=4555
 
-LIBADD=	ssh
-
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
-LIBADD+=	crypto
+LIBADD=	crypto ssh
 
 .include <bsd.prog.mk>
 
Index: secure/libexec/ssh-pkcs11-helper/Makefile
===================================================================
--- secure/libexec/ssh-pkcs11-helper/Makefile
+++ secure/libexec/ssh-pkcs11-helper/Makefile
@@ -7,15 +7,7 @@
 SRCS=	ssh-pkcs11.c ssh-pkcs11-helper.c
 MAN=	ssh-pkcs11-helper.8
 
-LIBADD=	ssh
-
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
-LIBADD+=	crypto
+LIBADD=	crypto ssh
 
 .include <bsd.prog.mk>
 
Index: secure/ssh.mk
===================================================================
--- secure/ssh.mk
+++ secure/ssh.mk
@@ -7,6 +7,14 @@
 CFLAGS+= -I${SSHDIR} -include ssh_namespace.h
 SRCS+=	 ssh_namespace.h
 
+.if ${MK_LDNS} != "no"
+CFLAGS+= -DHAVE_LDNS=1
+.endif
+
+.if ${MK_TCP_WRAPPERS} != "no"
+CFLAGS+= -DLIBWRAP=1
+.endif
+
 .if ${MK_USB} != "no"
 # Built-in security key support
 CFLAGS+= -include sk_config.h
Index: secure/usr.bin/scp/Makefile
===================================================================
--- secure/usr.bin/scp/Makefile
+++ secure/usr.bin/scp/Makefile
@@ -9,12 +9,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
Index: secure/usr.bin/sftp/Makefile
===================================================================
--- secure/usr.bin/sftp/Makefile
+++ secure/usr.bin/sftp/Makefile
@@ -9,12 +9,6 @@
 
 LIBADD=	ssh edit
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
Index: secure/usr.bin/ssh-add/Makefile
===================================================================
--- secure/usr.bin/ssh-add/Makefile
+++ secure/usr.bin/ssh-add/Makefile
@@ -9,12 +9,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
Index: secure/usr.bin/ssh-agent/Makefile
===================================================================
--- secure/usr.bin/ssh-agent/Makefile
+++ secure/usr.bin/ssh-agent/Makefile
@@ -7,20 +7,12 @@
 SRCS=	ssh-agent.c
 PACKAGE=	ssh
 
-LIBADD=	ssh
-
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
+LIBADD=	crypto ssh
 
 .if defined(LOCALBASE)
 CFLAGS+= -DDEFAULT_PKCS11_WHITELIST='"/usr/lib*/*,${LOCALBASE}/lib*/*"'
 .endif
 
-LIBADD+=	crypto
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
Index: secure/usr.bin/ssh-keygen/Makefile
===================================================================
--- secure/usr.bin/ssh-keygen/Makefile
+++ secure/usr.bin/ssh-keygen/Makefile
@@ -8,13 +8,7 @@
 SRCS=	ssh-keygen.c sshsig.c ssh-sk-client.c
 PACKAGE=	ssh
 
-LIBADD=	ssh
-
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-.endif
-
-LIBADD+=	crypto
+LIBADD=	crypto ssh
 
 .include <bsd.prog.mk>
 
Index: secure/usr.bin/ssh-keyscan/Makefile
===================================================================
--- secure/usr.bin/ssh-keyscan/Makefile
+++ secure/usr.bin/ssh-keyscan/Makefile
@@ -9,12 +9,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .include <bsd.prog.mk>
 
 .PATH:	${SSHDIR}
Index: secure/usr.bin/ssh/Makefile
===================================================================
--- secure/usr.bin/ssh/Makefile
+++ secure/usr.bin/ssh/Makefile
@@ -19,10 +19,6 @@
 
 LIBADD=	ssh
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-.endif
-
 .if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
 CFLAGS+= -include krb5_config.h
 SRCS+=	krb5_config.h
Index: secure/usr.sbin/sshd/Makefile
===================================================================
--- secure/usr.sbin/sshd/Makefile
+++ secure/usr.sbin/sshd/Makefile
@@ -33,12 +33,6 @@
 # pam should always happen before ssh here for static linking
 LIBADD=	pam ssh util
 
-.if ${MK_LDNS} != "no"
-CFLAGS+=	-DHAVE_LDNS=1
-#DPADD+=	${LIBLDNS}
-#LDADD+=	-lldns
-.endif
-
 .if ${MK_AUDIT} != "no"
 CFLAGS+= -DUSE_BSM_AUDIT=1 -DHAVE_GETAUDIT_ADDR=1
 LIBADD+=	bsm
@@ -58,7 +52,6 @@
 .endif
 
 .if ${MK_TCP_WRAPPERS} != "no"
-CFLAGS+=	-DLIBWRAP=1
 LIBADD+=	wrap
 .endif