diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc
index 001d962c2b..00b0653550 100644
--- a/src/DNS_Mgr.cc
+++ b/src/DNS_Mgr.cc
@@ -53,6 +53,8 @@ extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
 
 using namespace std;
 
+namespace zeek::detail {
+
 class DNS_Mgr_Request {
 public:
 	DNS_Mgr_Request(const char* h, int af, bool is_txt)
@@ -1462,3 +1464,5 @@ void DNS_Mgr::Terminate()
 	if ( nb_dns )
 		iosource_mgr->UnregisterFd(nb_dns_fd(nb_dns), this);
 	}
+
+} // namespace zeek::detail
diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h
index 2887ed1f99..f53bb6eba5 100644
--- a/src/DNS_Mgr.h
+++ b/src/DNS_Mgr.h
@@ -14,8 +14,8 @@
 #include "util.h"
 
 class EventHandler;
-class DNS_Mgr_Request;
 
+ZEEK_FORWARD_DECLARE_NAMESPACED(DNS_Mgr_Request, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek);
@@ -28,11 +28,14 @@ using ListValPtr = zeek::IntrusivePtr<ListVal>;
 using TableValPtr = zeek::IntrusivePtr<TableVal>;
 }
 
-using DNS_mgr_request_list = zeek::PList<DNS_Mgr_Request>;
-
+// Defined in nb_dns.h
 struct nb_dns_info;
 struct nb_dns_result;
 
+namespace zeek::detail {
+
+using DNS_mgr_request_list = zeek::PList<DNS_Mgr_Request>;
+
 class DNS_Mapping;
 
 enum DNS_MgrMode {
@@ -240,3 +243,14 @@ protected:
 };
 
 extern DNS_Mgr* dns_mgr;
+
+} // namespace zeek::detail
+
+using DNS_Mgr [[deprecated("Remove in v4.1. Use zeek::detail::DNS_Mgr.")]] = zeek::detail::DNS_Mgr;
+extern zeek::detail::DNS_Mgr*& dns_mgr [[deprecated("Remove in v4.1. Use zeek::detail::dns_mgr.")]];
+
+using DNS_MgrMode [[deprecated("Remove in v4.1. Use zeek::detail::DNS_MgrMode.")]] = zeek::detail::DNS_MgrMode;
+constexpr auto DNS_PRIME [[deprecated("Remove in v4.1. Use zeek::detail::DNS_PRIME.")]] = zeek::detail::DNS_PRIME;
+constexpr auto DNS_FORCE [[deprecated("Remove in v4.1. Use zeek::detail::DNS_FORCE.")]] = zeek::detail::DNS_FORCE;
+constexpr auto DNS_DEFAULT [[deprecated("Remove in v4.1. Use zeek::detail::DNS_DEFAULT.")]] = zeek::detail::DNS_DEFAULT;
+constexpr auto DNS_FAKE [[deprecated("Remove in v4.1. Use zeek::detail::DNS_FAKE.")]] = zeek::detail::DNS_FAKE;
diff --git a/src/Options.cc b/src/Options.cc
index b1474479b9..1bac746291 100644
--- a/src/Options.cc
+++ b/src/Options.cc
@@ -342,9 +342,9 @@ zeek::Options zeek::parse_cmdline(int argc, char** argv)
 				rval.pseudo_realtime = atof(optarg);
 			break;
 		case 'F':
-			if ( rval.dns_mode != DNS_DEFAULT )
+			if ( rval.dns_mode != zeek::detail::DNS_DEFAULT )
 				usage(zargs[0], 1);
-			rval.dns_mode = DNS_FORCE;
+			rval.dns_mode = zeek::detail::DNS_FORCE;
 			break;
 		case 'G':
 			rval.random_seed_input_file = optarg;
@@ -359,9 +359,9 @@ zeek::Options zeek::parse_cmdline(int argc, char** argv)
 			++rval.print_plugins;
 			break;
 		case 'P':
-			if ( rval.dns_mode != DNS_DEFAULT )
+			if ( rval.dns_mode != zeek::detail::DNS_DEFAULT )
 				usage(zargs[0], 1);
-			rval.dns_mode = DNS_PRIME;
+			rval.dns_mode = zeek::detail::DNS_PRIME;
 			break;
 		case 'Q':
 			rval.print_execution_time = true;
diff --git a/src/Options.h b/src/Options.h
index 2dcbdea853..496662739f 100644
--- a/src/Options.h
+++ b/src/Options.h
@@ -45,7 +45,7 @@ struct Options {
 	bool ignore_checksums = false;
 	bool use_watchdog = false;
 	double pseudo_realtime = 0;
-	DNS_MgrMode dns_mode = DNS_DEFAULT;
+	zeek::detail::DNS_MgrMode dns_mode = zeek::detail::DNS_DEFAULT;
 
 	bool supervisor_mode = false;
 	bool parse_only = false;
diff --git a/src/Stats.cc b/src/Stats.cc
index 1ce2572c1a..a7d76cd26e 100644
--- a/src/Stats.cc
+++ b/src/Stats.cc
@@ -183,8 +183,8 @@ void ProfileLogger::Log()
 		timer_mgr->Size(), timer_mgr->PeakSize(),
 		network_time - timer_mgr->LastTimestamp()));
 
-	DNS_Mgr::Stats dstats;
-	dns_mgr->GetStats(&dstats);
+	zeek::detail::DNS_Mgr::Stats dstats;
+	zeek::detail::dns_mgr->GetStats(&dstats);
 
 	file->Write(fmt("%.06f DNS_Mgr: requests=%lu succesful=%lu failed=%lu pending=%lu cached_hosts=%lu cached_addrs=%lu\n",
 					network_time,
diff --git a/src/scan.l b/src/scan.l
index a7441768c4..03aa5ad712 100644
--- a/src/scan.l
+++ b/src/scan.l
@@ -502,7 +502,7 @@ F	RET_CONST(zeek::val_mgr->False()->Ref())
 
 "0x"{HEX}+	RET_CONST(zeek::val_mgr->Count(static_cast<bro_uint_t>(strtoull(yytext, 0, 16))).release())
 
-{H}("."{H})+		RET_CONST(dns_mgr->LookupHost(yytext).release())
+{H}("."{H})+		RET_CONST(zeek::detail::dns_mgr->LookupHost(yytext).release())
 
 \"([^\\\n\"]|{ESCSEQ})*\"	{
 	const char* text = yytext;
diff --git a/src/stats.bif b/src/stats.bif
index 60c494de69..6bc2ed4fa2 100644
--- a/src/stats.bif
+++ b/src/stats.bif
@@ -249,8 +249,8 @@ function get_dns_stats%(%): DNSStats
 	auto r = zeek::make_intrusive<zeek::RecordVal>(DNSStats);
 	int n = 0;
 
-	DNS_Mgr::Stats dstats;
-	dns_mgr->GetStats(&dstats);
+	zeek::detail::DNS_Mgr::Stats dstats;
+	zeek::detail::dns_mgr->GetStats(&dstats);
 
 	r->Assign(n++, zeek::val_mgr->Count(unsigned(dstats.requests)));
 	r->Assign(n++, zeek::val_mgr->Count(unsigned(dstats.successful)));
diff --git a/src/zeek-setup.cc b/src/zeek-setup.cc
index 5c1e8b936f..b684e31297 100644
--- a/src/zeek-setup.cc
+++ b/src/zeek-setup.cc
@@ -96,7 +96,9 @@ zeek::plugin::Manager*& plugin_mgr = zeek::plugin_mgr;
 zeek::detail::RuleMatcher* zeek::detail::rule_matcher = nullptr;
 zeek::detail::RuleMatcher*& rule_matcher = zeek::detail::rule_matcher;
 
-DNS_Mgr* dns_mgr;
+zeek::detail::DNS_Mgr* zeek::detail::dns_mgr = nullptr;
+zeek::detail::DNS_Mgr*& dns_mgr = zeek::detail::dns_mgr;
+
 TimerMgr* timer_mgr;
 
 logging::Manager* log_mgr = nullptr;
@@ -239,7 +241,7 @@ void done_with_network()
 
 	zeek::analyzer_mgr->Done();
 	timer_mgr->Expire();
-	dns_mgr->Flush();
+	zeek::detail::dns_mgr->Flush();
 	mgr.Drain();
 	mgr.Drain();
 
@@ -300,7 +302,7 @@ void terminate_bro()
 	input_mgr->Terminate();
 	thread_mgr->Terminate();
 	broker_mgr->Terminate();
-	dns_mgr->Terminate();
+	zeek::detail::dns_mgr->Terminate();
 
 	mgr.Drain();
 
@@ -562,12 +564,12 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 
 	push_scope(nullptr, nullptr);
 
-	dns_mgr = new DNS_Mgr(dns_type);
+	zeek::detail::dns_mgr = new zeek::detail::DNS_Mgr(dns_type);
 
 	// It would nice if this were configurable.  This is similar to the
 	// chicken and the egg problem.  It would be configurable by parsing
 	// policy, but we can't parse policy without DNS resolution.
-	dns_mgr->SetDir(".state");
+	zeek::detail::dns_mgr->SetDir(".state");
 
 	iosource_mgr = new iosource::Manager();
 	event_registry = new EventRegistry();
@@ -668,7 +670,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 
 	zeek::analyzer_mgr->InitPostScript();
 	file_mgr->InitPostScript();
-	dns_mgr->InitPostScript();
+	zeek::detail::dns_mgr->InitPostScript();
 
 	if ( options.parse_only )
 		{
@@ -682,7 +684,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 
 	if ( reporter->Errors() > 0 )
 		{
-		delete dns_mgr;
+		delete zeek::detail::dns_mgr;
 		exit(1);
 		}
 
@@ -715,7 +717,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 		rule_matcher = new RuleMatcher(options.signature_re_level);
 		if ( ! rule_matcher->ReadFiles(all_signature_files) )
 			{
-			delete dns_mgr;
+			delete zeek::detail::dns_mgr;
 			exit(1);
 			}
 
@@ -760,14 +762,14 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 
 	if ( dns_type == DNS_PRIME )
 		{
-		dns_mgr->Verify();
-		dns_mgr->Resolve();
+		zeek::detail::dns_mgr->Verify();
+		zeek::detail::dns_mgr->Resolve();
 
-		if ( ! dns_mgr->Save() )
+		if ( ! zeek::detail::dns_mgr->Save() )
 			reporter->FatalError("can't update DNS cache");
 
 		mgr.Drain();
-		delete dns_mgr;
+		delete zeek::detail::dns_mgr;
 		exit(0);
 		}
 
diff --git a/src/zeek.bif b/src/zeek.bif
index c26981cfda..0c75205c26 100644
--- a/src/zeek.bif
+++ b/src/zeek.bif
@@ -3518,7 +3518,7 @@ function dump_packet%(pkt: pcap_packet, file_name: string%) : bool
 #include "DNS_Mgr.h"
 #include "Trigger.h"
 
-class LookupHostCallback : public DNS_Mgr::LookupCallback {
+class LookupHostCallback : public zeek::detail::DNS_Mgr::LookupCallback {
 public:
 	LookupHostCallback(zeek::detail::trigger::Trigger* arg_trigger, const zeek::detail::CallExpr* arg_call,
 				bool arg_lookup_name)
@@ -3534,7 +3534,7 @@ public:
 		Unref(trigger);
 		}
 
-	// Overridden from DNS_Mgr:Lookup:Callback.
+	// Overridden from zeek::detail::DNS_Mgr:Lookup:Callback.
 	virtual void Resolved(const char* name)
 		{
 		zeek::Val* result = new zeek::StringVal(name);
@@ -3602,7 +3602,7 @@ function lookup_addr%(host: addr%) : string
 	frame->SetDelayed();
 	trigger->Hold();
 
-	dns_mgr->AsyncLookupAddr(host->AsAddr(),
+	zeek::detail::dns_mgr->AsyncLookupAddr(host->AsAddr(),
 			new LookupHostCallback(trigger, frame->GetCall(), true));
 	return nullptr;
 	%}
@@ -3631,7 +3631,7 @@ function lookup_hostname_txt%(host: string%) : string
 	frame->SetDelayed();
 	trigger->Hold();
 
-	dns_mgr->AsyncLookupNameText(host->CheckString(),
+	zeek::detail::dns_mgr->AsyncLookupNameText(host->CheckString(),
 				 new LookupHostCallback(trigger, frame->GetCall(), true));
 	return nullptr;
 	%}
@@ -3660,7 +3660,7 @@ function lookup_hostname%(host: string%) : addr_set
 	frame->SetDelayed();
 	trigger->Hold();
 
-	dns_mgr->AsyncLookupName(host->CheckString(),
+	zeek::detail::dns_mgr->AsyncLookupName(host->CheckString(),
 			new LookupHostCallback(trigger, frame->GetCall(), false));
 	return nullptr;
 	%}