diff --git a/modules/geoipbackend/geoipinterface-dat.cc b/modules/geoipbackend/geoipinterface-dat.cc
index f694eca88398..db87a2057631 100644
--- a/modules/geoipbackend/geoipinterface-dat.cc
+++ b/modules/geoipbackend/geoipinterface-dat.cc
@@ -287,7 +287,7 @@ class GeoIPInterfaceDAT : public GeoIPInterface
         free(result);
         gl.netmask = tmp_gl.netmask;
         // reduce space to dash
-        ret = boost::replace_all_copy(ret, " ", "-");
+        std::replace(ret.begin(), ret.end(), ' ', '-');
         return true;
       }
     }
@@ -306,7 +306,7 @@ class GeoIPInterfaceDAT : public GeoIPInterface
         free(result);
         gl.netmask = tmp_gl.netmask;
         // reduce space to dash
-        ret = boost::replace_all_copy(ret, " ", "-");
+        std::replace(ret.begin(), ret.end(), ' ', '-');
         return true;
       }
     }
diff --git a/pdns/axfr-retriever.cc b/pdns/axfr-retriever.cc
index 6b87f5bd968f..4e93d3af2a19 100644
--- a/pdns/axfr-retriever.cc
+++ b/pdns/axfr-retriever.cc
@@ -31,11 +31,11 @@ using pdns::resolver::parseResult;
 
 AXFRRetriever::AXFRRetriever(const ComboAddress& remote,
                              const DNSName& domain,
-                             const TSIGTriplet& tt, 
+                             const TSIGTriplet& tsigConf,
                              const ComboAddress* laddr,
                              size_t maxReceivedBytes,
-                             uint16_t timeout)
-  : d_buf(65536), d_tsigVerifier(tt, remote, d_trc), d_receivedBytes(0), d_maxReceivedBytes(maxReceivedBytes)
+                             uint16_t timeout) :
+  d_buf(65536), d_tsigVerifier(tsigConf, remote, d_trc), d_maxReceivedBytes(maxReceivedBytes)
 {
   ComboAddress local;
   if (laddr != nullptr) {
@@ -59,17 +59,19 @@ AXFRRetriever::AXFRRetriever(const ComboAddress& remote,
     vector<uint8_t> packet;
     DNSPacketWriter pw(packet, domain, QType::AXFR);
     pw.getHeader()->id = dns_random_uint16();
-  
-    if(!tt.name.empty()) {
-      if (tt.algo == DNSName("hmac-md5"))
-        d_trc.d_algoName = tt.algo + DNSName("sig-alg.reg.int");
-      else
-        d_trc.d_algoName = tt.algo;
+
+    if (!tsigConf.name.empty()) {
+      if (tsigConf.algo == DNSName("hmac-md5")) {
+        d_trc.d_algoName = tsigConf.algo + DNSName("sig-alg.reg.int");
+      }
+      else {
+        d_trc.d_algoName = tsigConf.algo;
+      }
       d_trc.d_time = time(nullptr);
       d_trc.d_fudge = 300;
       d_trc.d_origID=ntohs(pw.getHeader()->id);
       d_trc.d_eRcode=0;
-      addTSIG(pw, d_trc, tt.name, tt.secret, "", false);
+      addTSIG(pw, d_trc, tsigConf.name, tsigConf.secret, "", false);
     }
   
     uint16_t replen=htons(packet.size());
diff --git a/pdns/axfr-retriever.hh b/pdns/axfr-retriever.hh
index 81362b754b5a..18e37f6c5da4 100644
--- a/pdns/axfr-retriever.hh
+++ b/pdns/axfr-retriever.hh
@@ -51,6 +51,6 @@ class AXFRRetriever : public boost::noncopyable
     TSIGRecordContent d_trc;
     TSIGTCPVerifier d_tsigVerifier;
 
-    size_t d_receivedBytes;
+    size_t d_receivedBytes{0};
     size_t d_maxReceivedBytes;
 };
diff --git a/pdns/bindparserclasses.hh b/pdns/bindparserclasses.hh
index 1063de98ecb2..655367abdfef 100644
--- a/pdns/bindparserclasses.hh
+++ b/pdns/bindparserclasses.hh
@@ -32,9 +32,6 @@
 class BindDomainInfo 
 {
 public:
-  BindDomainInfo() : hadFileDirective(false), d_dev(0), d_ino(0)
-  {}
-
   void clear() 
   {
     name=DNSName();
@@ -50,10 +47,10 @@ public:
   vector<ComboAddress> primaries;
   set<string> alsoNotify;
   string type;
-  bool hadFileDirective;
-    
-  dev_t d_dev;
-  ino_t d_ino;
+  bool hadFileDirective{false};
+
+  dev_t d_dev{0};
+  ino_t d_ino{0};
 
   bool operator<(const BindDomainInfo& b) const
   {
@@ -66,14 +63,14 @@ extern FILE *yyin;
 class BindParser
 {
  public:
-  BindParser() : d_dir("."), d_verbose(false)
-  {
-    yyin=0;
-    extern int include_stack_ptr;
-    include_stack_ptr=0;
- 
-    bind_directory=d_dir.c_str(); 
-  }
+   BindParser()
+   {
+     yyin = 0;
+     extern int include_stack_ptr;
+     include_stack_ptr = 0;
+
+     bind_directory = d_dir.c_str();
+   }
   ~BindParser()
   {
     if(yyin) {
@@ -90,9 +87,9 @@ class BindParser
   void addAlsoNotify(const string &host);
   set<string> & getAlsoNotify() { return this->alsoNotify; } 
 private:
-  string d_dir;
+  string d_dir{"."};
   typedef map<DNSName,string> zonedomain_t;
   set<string> alsoNotify;
   vector<BindDomainInfo> d_zonedomains;
-  bool d_verbose;
+  bool d_verbose{false};
 };
diff --git a/pdns/comment.hh b/pdns/comment.hh
index 1608cffec816..b121e1c5166f 100644
--- a/pdns/comment.hh
+++ b/pdns/comment.hh
@@ -27,15 +27,12 @@
 class Comment
 {
 public:
-  Comment() : modified_at(0), domain_id(0)  {};
-  ~Comment() = default;
-
   // data
   DNSName qname; //!< the name of the associated RRset, for example: www.powerdns.com
-  time_t modified_at;
+  time_t modified_at{0};
   string account; //!< account last updating this comment
   string content; //!< The actual comment. Example: blah blah
 
-  int domain_id;
+  int domain_id{0};
   QType qtype; //!< qtype of the associated RRset, ie A, CNAME, MX etc
 };
diff --git a/pdns/communicator.hh b/pdns/communicator.hh
index 768b8dee716d..4fba795a5084 100644
--- a/pdns/communicator.hh
+++ b/pdns/communicator.hh
@@ -29,6 +29,7 @@
 #include <boost/multi_index_container.hpp>
 #include <boost/multi_index/identity.hpp>
 #include <boost/multi_index/sequenced_index.hpp>
+#include <utility>
 using namespace boost::multi_index;
 
 #include <unistd.h>
@@ -234,8 +235,8 @@ private:
 
   struct RemoveSentinel
   {
-    explicit RemoveSentinel(const DNSName& dn, CommunicatorClass* cc) :
-      d_dn(dn), d_cc(cc)
+    explicit RemoveSentinel(DNSName dn, CommunicatorClass* cc) :
+      d_dn(std::move(dn)), d_cc(cc)
     {}
 
     ~RemoveSentinel()
diff --git a/pdns/dnsbackend.hh b/pdns/dnsbackend.hh
index 80192e59960b..7333551ffb26 100644
--- a/pdns/dnsbackend.hh
+++ b/pdns/dnsbackend.hh
@@ -485,8 +485,8 @@ private:
 class BackendFactory
 {
 public:
-  BackendFactory(const string& name) :
-    d_name(name) {}
+  BackendFactory(string name) :
+    d_name(std::move(name)) {}
   virtual ~BackendFactory() = default;
   virtual DNSBackend* make(const string& suffix) = 0;
   virtual DNSBackend* makeMetadataOnly(const string& suffix)
diff --git a/pdns/dnsdistdist/dnsdist-actions.cc b/pdns/dnsdistdist/dnsdist-actions.cc
index ad19901f2a6c..a56079915f38 100644
--- a/pdns/dnsdistdist/dnsdist-actions.cc
+++ b/pdns/dnsdistdist/dnsdist-actions.cc
@@ -45,7 +45,7 @@ DNSAction::Action DNSAction::typeFromString(const std::string& str)
   };
 
   auto lower = boost::to_lower_copy(str);
-  boost::replace_all(lower, "-", "");
+  lower.erase(std::remove(lower.begin(), lower.end(), '-'), lower.end());
   auto mappingIt = s_mappings.find(lower);
   if (mappingIt != s_mappings.end()) {
     return mappingIt->second;
diff --git a/pdns/dnsdistdist/dnsdist-carbon.cc b/pdns/dnsdistdist/dnsdist-carbon.cc
index 66ec734250e4..eee7a5df96e4 100644
--- a/pdns/dnsdistdist/dnsdist-carbon.cc
+++ b/pdns/dnsdistdist/dnsdist-carbon.cc
@@ -78,7 +78,7 @@ static bool doOneCarbonExport(const Carbon::Endpoint& endpoint)
 
     for (const auto& state : dnsdist::configuration::getCurrentRuntimeConfiguration().d_backends) {
       string serverName = state->getName().empty() ? state->d_config.remote.toStringWithPort() : state->getName();
-      boost::replace_all(serverName, ".", "_");
+      std::replace(serverName.begin(), serverName.end(), '.', '_');
       string base = namespace_name;
       base += ".";
       base += hostname;
@@ -123,7 +123,7 @@ static bool doOneCarbonExport(const Carbon::Endpoint& endpoint)
       }
 
       string frontName = front->local.toStringWithPort() + (front->udpFD >= 0 ? "_udp" : "_tcp");
-      boost::replace_all(frontName, ".", "_");
+      std::replace(frontName.begin(), frontName.end(), '.', '_');
       auto dupPair = frontendDuplicates.insert({frontName, 1});
       if (!dupPair.second) {
         frontName += "_" + std::to_string(dupPair.first->second);
@@ -180,7 +180,7 @@ static bool doOneCarbonExport(const Carbon::Endpoint& endpoint)
 
     for (const auto& entry : dnsdist::configuration::getCurrentRuntimeConfiguration().d_pools) {
       string poolName = entry.first;
-      boost::replace_all(poolName, ".", "_");
+      std::replace(poolName.begin(), poolName.end(), '.', '_');
       if (poolName.empty()) {
         poolName = "_default_";
       }
@@ -228,10 +228,10 @@ static bool doOneCarbonExport(const Carbon::Endpoint& endpoint)
       const string base = "dnsdist." + hostname + ".main.doh.";
       for (const auto& doh : dnsdist::getDoHFrontends()) {
         string name = doh->d_tlsContext.d_addr.toStringWithPort();
-        boost::replace_all(name, ".", "_");
-        boost::replace_all(name, ":", "_");
-        boost::replace_all(name, "[", "_");
-        boost::replace_all(name, "]", "_");
+        std::replace(name.begin(), name.end(), '.', '_');
+        std::replace(name.begin(), name.end(), ':', '_');
+        std::replace(name.begin(), name.end(), '[', '_');
+        std::replace(name.begin(), name.end(), ']', '_');
 
         auto dupPair = dohFrontendDuplicates.insert({name, 1});
         if (!dupPair.second) {
@@ -274,7 +274,7 @@ static bool doOneCarbonExport(const Carbon::Endpoint& endpoint)
       auto records = dnsdist::QueryCount::g_queryCountRecords.write_lock();
       for (const auto& record : *records) {
         qname = record.first;
-        boost::replace_all(qname, ".", "_");
+        std::replace(qname.begin(), qname.end(), '.', '_');
         str << "dnsdist.querycount." << qname << ".queries " << record.second << " " << now << "\r\n";
       }
       records->clear();
diff --git a/pdns/dnsdistdist/dnsdist-secpoll.cc b/pdns/dnsdistdist/dnsdist-secpoll.cc
index 5f6bb5733355..647b09fb83ae 100644
--- a/pdns/dnsdistdist/dnsdist-secpoll.cc
+++ b/pdns/dnsdistdist/dnsdist-secpoll.cc
@@ -205,8 +205,8 @@ void doSecPoll(const std::string& suffix)
     queriedName += '.';
   }
 
-  boost::replace_all(queriedName, "+", "_");
-  boost::replace_all(queriedName, "~", "_");
+  std::replace(queriedName.begin(), queriedName.end(), '+', '_');
+  std::replace(queriedName.begin(), queriedName.end(), '~', '_');
 
   try {
     std::string status = getSecPollStatus(queriedName);
diff --git a/pdns/dnsdistdist/dnsdist-web.cc b/pdns/dnsdistdist/dnsdist-web.cc
index 94db95c31ae1..f6a310f30f65 100644
--- a/pdns/dnsdistdist/dnsdist-web.cc
+++ b/pdns/dnsdistdist/dnsdist-web.cc
@@ -623,7 +623,7 @@ static void handlePrometheus(const YaHTTP::Request& req, YaHTTP::Response& resp)
       serverName = state->getName();
     }
 
-    boost::replace_all(serverName, ".", "_");
+    std::replace(serverName.begin(), serverName.end(), '.', '_');
 
     const std::string label = boost::str(boost::format(R"({server="%1%",address="%2%"})")
                                          % serverName % state->d_config.remote.toStringWithPort());
diff --git a/pdns/dnsdistdist/doh.cc b/pdns/dnsdistdist/doh.cc
index 739684477b82..eb95c1302ce5 100644
--- a/pdns/dnsdistdist/doh.cc
+++ b/pdns/dnsdistdist/doh.cc
@@ -1145,8 +1145,8 @@ static int doh_handler(h2o_handler_t *self, h2o_req_t *req)
       if (pos != string::npos) {
         // need to base64url decode this
         string sdns(path.substr(pos+5));
-        boost::replace_all(sdns,"-", "+");
-        boost::replace_all(sdns,"_", "/");
+        std::replace(sdns.begin(), sdns.end(), '-', '+');
+        std::replace(sdns.begin(), sdns.end(), '_', '/');
         // re-add padding that may have been missing
         switch (sdns.size() % 4) {
         case 2:
diff --git a/pdns/dnsname.hh b/pdns/dnsname.hh
index ccf8eb004de6..398c27c9d315 100644
--- a/pdns/dnsname.hh
+++ b/pdns/dnsname.hh
@@ -24,6 +24,7 @@
 #include <cstring>
 #include <optional>
 #include <string>
+#include <utility>
 #include <vector>
 #include <set>
 #include <strings.h>
@@ -306,7 +307,8 @@ extern const DNSName g_rootdnsname, g_wildcarddnsname;
 template<typename T>
 struct SuffixMatchTree
 {
-  SuffixMatchTree(const std::string& name="", bool endNode_=false) : d_name(name), endNode(endNode_)
+  SuffixMatchTree(std::string name = "", bool endNode_ = false) :
+    d_name(std::move(name)), endNode(endNode_)
   {}
 
   SuffixMatchTree(const SuffixMatchTree& rhs): d_name(rhs.d_name), children(rhs.children), endNode(rhs.endNode)
diff --git a/pdns/dnsrecords.hh b/pdns/dnsrecords.hh
index 1913bfa50198..7bddcc2b6d6f 100644
--- a/pdns/dnsrecords.hh
+++ b/pdns/dnsrecords.hh
@@ -30,6 +30,7 @@
 #include "rcpgenerator.hh"
 #include <set>
 #include <bitset>
+#include <utility>
 #include "namespaces.hh"
 #include "iputils.hh"
 #include "svc-records.hh"
@@ -289,8 +290,8 @@ private:
 class NSRecordContent : public DNSRecordContent
 {
 public:
-  includeboilerplate(NS)
-  explicit NSRecordContent(const DNSName& content) : d_content(content){}
+  includeboilerplate(NS) explicit NSRecordContent(DNSName content) :
+    d_content(std::move(content)) {}
   const DNSName& getNS() const { return d_content; }
   bool operator==(const DNSRecordContent& rhs) const override
   {
@@ -310,8 +311,8 @@ private:
 class PTRRecordContent : public DNSRecordContent
 {
 public:
-  includeboilerplate(PTR)
-  explicit PTRRecordContent(const DNSName& content) : d_content(content){}
+  includeboilerplate(PTR) explicit PTRRecordContent(DNSName content) :
+    d_content(std::move(content)) {}
   const DNSName& getContent() const { return d_content; }
   [[nodiscard]] size_t sizeEstimate() const override
   {
@@ -325,7 +326,8 @@ class CNAMERecordContent : public DNSRecordContent
 {
 public:
   includeboilerplate(CNAME)
-  CNAMERecordContent(const DNSName& content) : d_content(content){}
+    CNAMERecordContent(DNSName content) :
+    d_content(std::move(content)) {}
   DNSName getTarget() const { return d_content; }
   [[nodiscard]] size_t sizeEstimate() const override
   {
@@ -358,7 +360,8 @@ class DNAMERecordContent : public DNSRecordContent
 {
 public:
   includeboilerplate(DNAME)
-  DNAMERecordContent(const DNSName& content) : d_content(content){}
+    DNAMERecordContent(DNSName content) :
+    d_content(std::move(content)) {}
   const DNSName& getTarget() const { return d_content; }
   [[nodiscard]] size_t sizeEstimate() const override
   {
diff --git a/pdns/dnswriter.cc b/pdns/dnswriter.cc
index 96a66a1a8bbe..5ee38dd75754 100644
--- a/pdns/dnswriter.cc
+++ b/pdns/dnswriter.cc
@@ -40,9 +40,9 @@
 
 */
 
-
-template <typename Container> GenericDNSPacketWriter<Container>::GenericDNSPacketWriter(Container& content, const DNSName& qname, uint16_t  qtype, uint16_t qclass, uint8_t opcode)
-  : d_content(content), d_qname(qname), d_canonic(false), d_lowerCase(false)
+template <typename Container>
+GenericDNSPacketWriter<Container>::GenericDNSPacketWriter(Container& content, const DNSName& qname, uint16_t qtype, uint16_t qclass, uint8_t opcode) :
+  d_content(content), d_qname(qname)
 {
   d_content.clear();
   dnsheader dnsheader;
diff --git a/pdns/dnswriter.hh b/pdns/dnswriter.hh
index adccd8365b6e..37829e56c5b1 100644
--- a/pdns/dnswriter.hh
+++ b/pdns/dnswriter.hh
@@ -172,8 +172,8 @@ private:
   DNSName d_qname;
 
   uint16_t d_truncatemarker; // end of header, for truncate
-  DNSResourceRecord::Place d_recordplace;
-  bool d_canonic, d_lowerCase, d_compress{false};
+  DNSResourceRecord::Place d_recordplace{DNSResourceRecord::QUESTION};
+  bool d_canonic{false}, d_lowerCase{false}, d_compress{false};
 };
 
 using DNSPacketWriter = GenericDNSPacketWriter<std::vector<uint8_t>>;
diff --git a/pdns/inflighter.cc b/pdns/inflighter.cc
index e770ea4c4aec..6bdc6d74b0e5 100644
--- a/pdns/inflighter.cc
+++ b/pdns/inflighter.cc
@@ -44,7 +44,8 @@ struct TimeTag{};
 template<typename Container, typename SenderReceiver> class Inflighter
 {
 public:
-  Inflighter(Container& c, SenderReceiver& sr) : d_container(c), d_sr(sr), d_init(false)
+  Inflighter(Container& c, SenderReceiver& sr) :
+    d_container(c), d_sr(sr)
   {
     d_burst = 2;
     d_maxInFlight = 5;
@@ -99,8 +100,8 @@ template<typename Container, typename SenderReceiver> class Inflighter
   
   ttdwatch_t d_ttdWatch;
   typename Container::iterator d_iter;
-  bool d_init;
-  
+  bool d_init{false};
+
   uint64_t d_unexpectedResponse, d_timeouts;
 };
 
diff --git a/pdns/logger.cc b/pdns/logger.cc
index c31651552deb..52a5f08f72fe 100644
--- a/pdns/logger.cc
+++ b/pdns/logger.cc
@@ -165,7 +165,7 @@ void Logger::setName(const string& _name)
 }
 
 Logger::Logger(string n, int facility) :
-  name(std::move(n)), flags(LOG_PID | LOG_NDELAY), d_facility(facility), d_loglevel(Logger::None), consoleUrgency(Error), opened(false), d_disableSyslog(false)
+  name(std::move(n)), flags(LOG_PID | LOG_NDELAY), d_facility(facility)
 {
   open();
 }
diff --git a/pdns/logger.hh b/pdns/logger.hh
index 9a84661442c1..d1581809c4f3 100644
--- a/pdns/logger.hh
+++ b/pdns/logger.hh
@@ -138,11 +138,8 @@ public:
 private:
   struct PerThread
   {
-    PerThread() :
-      d_urgency(Info)
-    {}
     string d_output;
-    Urgency d_urgency;
+    Urgency d_urgency{Info};
   };
   PerThread& getPerThread();
   void open();
@@ -151,10 +148,10 @@ private:
   string name;
   int flags;
   int d_facility;
-  Urgency d_loglevel;
-  Urgency consoleUrgency;
-  bool opened;
-  bool d_disableSyslog;
+  Urgency d_loglevel{Logger::None};
+  Urgency consoleUrgency{Error};
+  bool opened{false};
+  bool d_disableSyslog{false};
   bool d_timestamps{true};
   bool d_prefixed{false}; // this used to prefix the loglevel, but now causes formatting like structured logging
 };
diff --git a/pdns/lua-base4.hh b/pdns/lua-base4.hh
index 1786d0ff78cc..884921817b5d 100644
--- a/pdns/lua-base4.hh
+++ b/pdns/lua-base4.hh
@@ -1,6 +1,7 @@
 #pragma once
 #include "namespaces.hh"
 #include <boost/variant/variant.hpp>
+#include <utility>
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -13,7 +14,8 @@ protected:
   std::string d_include_path; // path where scripts to include at postLoad are
 
 public:
-  BaseLua4(const std::string &includePath) : d_include_path(includePath) {};
+  BaseLua4(std::string includePath) :
+    d_include_path(std::move(includePath)) {};
   void loadFile(const std::string &fname, bool doPostLoad=true);
   void loadString(const std::string &script);
   void loadStream(std::istream &stream, bool doPostLoad=true);
diff --git a/pdns/lua-record.cc b/pdns/lua-record.cc
index f450cc0a0c59..36bfdccd0a84 100644
--- a/pdns/lua-record.cc
+++ b/pdns/lua-record.cc
@@ -930,7 +930,7 @@ static void setupLuaRecords(LuaContext& lua) // NOLINT(readability-function-cogn
       vector<ComboAddress> candidates;
       // Getting something like 192-0-2-1.192-0-2-2.198-51-100-1.example.org
       for(auto l : s_lua_record_ctx->qname.getRawLabels()) {
-        boost::replace_all(l, "-", ".");
+        std::replace(l.begin(), l.end(), '-', '.');
         try {
           candidates.emplace_back(l);
         } catch (const PDNSException& e) {
@@ -1071,7 +1071,7 @@ static void setupLuaRecords(LuaContext& lua) // NOLINT(readability-function-cogn
       }
       else if(parts.size()==1) {
         if (parts[0].find('-') != std::string::npos) {
-          boost::replace_all(parts[0],"-",":");
+          std::replace(parts[0].begin(), parts[0].end(), '-', ':');
           ComboAddress ca(parts[0]);
           return ca.toString();
         } else {
@@ -1130,7 +1130,7 @@ static void setupLuaRecords(LuaContext& lua) // NOLINT(readability-function-cogn
         }
 
         string dashed=ip6.toString();
-        boost::replace_all(dashed, ":", "-");
+        std::replace(dashed.begin(), dashed.end(), ':', '-');
 
         // https://github.com/PowerDNS/pdns/issues/7524
         if (boost::ends_with(dashed, "-")) {
diff --git a/pdns/misc.cc b/pdns/misc.cc
index 1cc6d5114b2c..8f0a7bd45333 100644
--- a/pdns/misc.cc
+++ b/pdns/misc.cc
@@ -568,7 +568,7 @@ std::string getCarbonHostName()
     throw std::runtime_error(stringerror());
   }
 
-  boost::replace_all(*hostname, ".", "_");
+  std::replace(hostname->begin(), hostname->end(), '.', '_');
   return *hostname;
 }
 
diff --git a/pdns/misc.hh b/pdns/misc.hh
index 66dd0ccf3e33..1082b47c5ad6 100644
--- a/pdns/misc.hh
+++ b/pdns/misc.hh
@@ -39,6 +39,7 @@
 #include <stdexcept>
 #include <string>
 #include <cctype>
+#include <utility>
 #include <vector>
 
 #include "namespaces.hh"
@@ -528,7 +529,8 @@ private:
 class SimpleMatch
 {
 public:
-  SimpleMatch(const string &mask, bool caseFold = false): d_mask(mask), d_fold(caseFold)
+  SimpleMatch(string mask, bool caseFold = false) :
+    d_mask(std::move(mask)), d_fold(caseFold)
   {
   }
 
diff --git a/pdns/mplexer.hh b/pdns/mplexer.hh
index 13748fb59e4b..3f22a4f85f37 100644
--- a/pdns/mplexer.hh
+++ b/pdns/mplexer.hh
@@ -70,9 +70,6 @@ protected:
   };
 
 public:
-  FDMultiplexer() :
-    d_inrun(false)
-  {}
   virtual ~FDMultiplexer() = default;
 
   // The maximum number of events processed in a single run, not the maximum of watched descriptors
@@ -221,11 +218,11 @@ public:
     const auto tied = std::tie(tv.tv_sec, tv.tv_usec);
     auto& idx = writes ? d_writeCallbacks.get<TTDOrderedTag>() : d_readCallbacks.get<TTDOrderedTag>();
 
-    for (auto it = idx.begin(); it != idx.end(); ++it) {
-      if (it->d_ttd.tv_sec == 0 || tied <= std::tie(it->d_ttd.tv_sec, it->d_ttd.tv_usec)) {
+    for (const auto& t : idx) {
+      if (t.d_ttd.tv_sec == 0 || tied <= std::tie(t.d_ttd.tv_sec, t.d_ttd.tv_usec)) {
         break;
       }
-      ret.emplace_back(it->d_fd, it->d_parameter);
+      ret.emplace_back(t.d_fd, t.d_parameter);
     }
 
     return ret;
@@ -296,7 +293,7 @@ protected:
     callbackmap_t;
 
   callbackmap_t d_readCallbacks, d_writeCallbacks;
-  bool d_inrun;
+  bool d_inrun{false};
 
   void accountingAddFD(callbackmap_t& cbmap, int fd, callbackfunc_t toDo, const funcparam_t& parameter, const struct timeval* ttd)
   {
diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 8483814d1954..e63a5d9c8a8d 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -139,8 +139,7 @@ bool PacketHandler::addCDNSKEY(DNSPacket& p, std::unique_ptr<DNSPacket>& r)
   }
 
   bool haveOne=false;
-  DNSSECKeeper::keyset_t entryPoints = d_dk.getEntryPoints(p.qdomain);
-  for(const auto& value: entryPoints) {
+  for (const auto& value : d_dk.getEntryPoints(p.qdomain)) {
     if (!value.second.published) {
       continue;
     }
@@ -173,8 +172,7 @@ bool PacketHandler::addDNSKEY(DNSPacket& p, std::unique_ptr<DNSPacket>& r)
   DNSZoneRecord rr;
   bool haveOne=false;
 
-  DNSSECKeeper::keyset_t keyset = d_dk.getKeys(p.qdomain);
-  for(const auto& value: keyset) {
+  for (const auto& value : d_dk.getKeys(p.qdomain)) {
     if (!value.second.published) {
       continue;
     }
@@ -232,9 +230,7 @@ bool PacketHandler::addCDS(DNSPacket& p, std::unique_ptr<DNSPacket>& r)
 
   bool haveOne=false;
 
-  DNSSECKeeper::keyset_t keyset = d_dk.getEntryPoints(p.qdomain);
-
-  for(auto const &value : keyset) {
+  for (const auto& value : d_dk.getEntryPoints(p.qdomain)) {
     if (!value.second.published) {
       continue;
     }
@@ -1283,9 +1279,9 @@ bool PacketHandler::tryDNAME(DNSPacket& p, std::unique_ptr<DNSPacket>& r, DNSNam
   try {
     getBestDNAMESynth(p, target, rrset);
     if(!rrset.empty()) {
-      for(size_t i = 0; i < rrset.size(); i++) {
-        rrset.at(i).dr.d_place = DNSResourceRecord::ANSWER;
-        r->addRecord(std::move(rrset.at(i)));
+      for (auto& record : rrset) {
+        record.dr.d_place = DNSResourceRecord::ANSWER;
+        r->addRecord(std::move(record));
       }
       return true;
     }
@@ -1293,9 +1289,9 @@ bool PacketHandler::tryDNAME(DNSPacket& p, std::unique_ptr<DNSPacket>& r, DNSNam
     // Add the DNAME regardless, but throw to let the caller know we could not
     // synthesize a CNAME
     if(!rrset.empty()) {
-      for(size_t i = 0; i < rrset.size(); i++) {
-        rrset.at(i).dr.d_place = DNSResourceRecord::ANSWER;
-        r->addRecord(std::move(rrset.at(i)));
+      for (auto& record : rrset) {
+        record.dr.d_place = DNSResourceRecord::ANSWER;
+        r->addRecord(std::move(record));
       }
     }
     throw e;
diff --git a/pdns/pdnsexception.hh b/pdns/pdnsexception.hh
index 8960816b709f..3417fe177bd4 100644
--- a/pdns/pdnsexception.hh
+++ b/pdns/pdnsexception.hh
@@ -21,6 +21,7 @@
  */
 #pragma once
 #include<string>
+#include <utility>
 
 #include "namespaces.hh"
 
@@ -29,8 +30,9 @@ class PDNSException
 {
 public:
   PDNSException() : reason("Unspecified") {};
-  PDNSException(const string& r) : reason(r) {};
-  
+  PDNSException(string r) :
+    reason(std::move(r)) {};
+
   string reason; //! Print this to tell the user what went wrong
 };
 
diff --git a/pdns/rcpgenerator.cc b/pdns/rcpgenerator.cc
index fb5869dd126d..db5e48933c31 100644
--- a/pdns/rcpgenerator.cc
+++ b/pdns/rcpgenerator.cc
@@ -36,7 +36,8 @@
 #include "base64.hh"
 #include "namespaces.hh"
 
-RecordTextReader::RecordTextReader(string  str, DNSName  zone) : d_string(std::move(str)), d_zone(std::move(zone)), d_pos(0)
+RecordTextReader::RecordTextReader(string str, DNSName zone) :
+  d_string(std::move(str)), d_zone(std::move(zone))
 {
    /* remove whitespace */
    if(!d_string.empty() && ( dns_isspace(*d_string.begin()) || dns_isspace(*d_string.rbegin()) ))
diff --git a/pdns/rcpgenerator.hh b/pdns/rcpgenerator.hh
index a550177d51a2..914a353aa884 100644
--- a/pdns/rcpgenerator.hh
+++ b/pdns/rcpgenerator.hh
@@ -77,7 +77,7 @@ public:
 private:
   string d_string;
   DNSName d_zone;
-  string::size_type d_pos;
+  string::size_type d_pos{0};
   string::size_type d_end;
   void skipSpaces();
 };
diff --git a/pdns/recursordist/secpoll-recursor.cc b/pdns/recursordist/secpoll-recursor.cc
index b54ae7dc5c71..6c89a406a1da 100644
--- a/pdns/recursordist/secpoll-recursor.cc
+++ b/pdns/recursordist/secpoll-recursor.cc
@@ -49,8 +49,8 @@ void doSecPoll(time_t* last_secpoll, Logr::log_t log)
     qstring += '.';
   }
 
-  boost::replace_all(qstring, "+", "_");
-  boost::replace_all(qstring, "~", "_");
+  std::replace(qstring.begin(), qstring.end(), '+', '_');
+  std::replace(qstring.begin(), qstring.end(), '~', '_');
 
   vState state = vState::Indeterminate;
   DNSName query(qstring);
diff --git a/pdns/secpoll-auth.cc b/pdns/secpoll-auth.cc
index 7cc132aada7a..139f28acfd2f 100644
--- a/pdns/secpoll-auth.cc
+++ b/pdns/secpoll-auth.cc
@@ -44,8 +44,8 @@ void doSecPoll(bool first)
   if(*query.rbegin()!='.')
     query+='.';
 
-  boost::replace_all(query, "+", "_");
-  boost::replace_all(query, "~", "_");
+  std::replace(query.begin(), query.end(), '+', '_');
+  std::replace(query.begin(), query.end(), '~', '_');
 
   int security_status = std::stoi(S.getValueStr("security-status"));
 
diff --git a/pdns/signingpipe.cc b/pdns/signingpipe.cc
index 25f3d59b9f97..f2464c11b079 100644
--- a/pdns/signingpipe.cc
+++ b/pdns/signingpipe.cc
@@ -59,9 +59,8 @@ catch(...) {
   return nullptr;
 }
 
-ChunkedSigningPipe::ChunkedSigningPipe(DNSName  signerName, bool mustSign, unsigned int workers, unsigned int maxChunkRecords)
-  : d_signed(0), d_queued(0), d_outstanding(0), d_numworkers(workers), d_submitted(0), d_signer(std::move(signerName)),
-    d_maxchunkrecords(maxChunkRecords), d_threads(d_numworkers), d_mustSign(mustSign), d_final(false)
+ChunkedSigningPipe::ChunkedSigningPipe(DNSName signerName, bool mustSign, unsigned int workers, unsigned int maxChunkRecords) :
+  d_signed(0), d_numworkers(workers), d_signer(std::move(signerName)), d_maxchunkrecords(maxChunkRecords), d_threads(d_numworkers), d_mustSign(mustSign)
 {
   d_rrsetToSign = make_unique<rrset_t>();
   d_chunks.push_back(vector<DNSZoneRecord>()); // load an empty chunk
diff --git a/pdns/signingpipe.hh b/pdns/signingpipe.hh
index c72b54178641..d76ebda730c3 100644
--- a/pdns/signingpipe.hh
+++ b/pdns/signingpipe.hh
@@ -49,8 +49,8 @@ public:
   unsigned int getReady() const;
 
   std::atomic<unsigned long> d_signed;
-  unsigned int d_queued;
-  unsigned int d_outstanding;
+  unsigned int d_queued{0};
+  unsigned int d_outstanding{0};
 
 private:
   void flushToSign();	
@@ -63,7 +63,7 @@ private:
   void worker(int fd);
 
   unsigned int d_numworkers;
-  unsigned int d_submitted;
+  unsigned int d_submitted{0};
 
   std::unique_ptr<rrset_t> d_rrsetToSign;
   std::deque< std::vector<DNSZoneRecord> > d_chunks;
@@ -77,5 +77,5 @@ private:
 
   vector<std::thread> d_threads;
   bool d_mustSign;
-  bool d_final;
+  bool d_final{false};
 };
diff --git a/pdns/test-misc_hh.cc b/pdns/test-misc_hh.cc
index bb903d623605..45e9e375f964 100644
--- a/pdns/test-misc_hh.cc
+++ b/pdns/test-misc_hh.cc
@@ -213,7 +213,7 @@ BOOST_AUTO_TEST_CASE(test_getCarbonHostName)
 
   BOOST_CHECK_EQUAL(gethostname(buffer, sizeof buffer), 0);
   std::string my_hostname(buffer);
-  boost::replace_all(my_hostname, ".", "_");
+  std::replace(my_hostname.begin(), my_hostname.end(), '.', '_');
 
   std::string hostname = getCarbonHostName();
   // ensure it matches what we get
diff --git a/pdns/webserver.cc b/pdns/webserver.cc
index 58fb65c0ff16..fea0724d5382 100644
--- a/pdns/webserver.cc
+++ b/pdns/webserver.cc
@@ -587,8 +587,8 @@ WebServer::WebServer(string listenaddress, int port) :
   d_listenaddress(std::move(listenaddress)),
   d_port(port),
   d_server(nullptr),
-  d_maxbodysize(2*1024*1024),
-  d_connectiontimeout(5)
+  d_maxbodysize(static_cast<ssize_t>(2 * 1024 * 1024))
+
 {
     YaHTTP::Router::Map("OPTIONS", "/<*url>", [](YaHTTP::Request *req, YaHTTP::Response *resp) {
       // look for url in routes
diff --git a/pdns/webserver.hh b/pdns/webserver.hh
index 5b83d70712e9..e1f3795f6912 100644
--- a/pdns/webserver.hh
+++ b/pdns/webserver.hh
@@ -26,6 +26,7 @@
 #include <boost/utility.hpp>
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Woverloaded-virtual"
+#include <utility>
 #include <yahttp/yahttp.hpp>
 #pragma GCC diagnostic pop
 
@@ -38,7 +39,8 @@
 
 class HttpRequest : public YaHTTP::Request {
 public:
-  HttpRequest(const string& logprefix_="") : YaHTTP::Request(), logprefix(logprefix_) { };
+  HttpRequest(string logprefix_ = "") :
+    YaHTTP::Request(), logprefix(std::move(logprefix_)) {};
 
   string logprefix;
   bool accept_yaml{false};
@@ -289,7 +291,7 @@ protected:
   std::unique_ptr<CredentialsHolder> d_webserverPassword{nullptr};
 
   ssize_t d_maxbodysize; // in bytes
-  int d_connectiontimeout; // in seconds
+  int d_connectiontimeout{5}; // in seconds
 
   NetmaskGroup d_acl;
 
diff --git a/pdns/ws-auth.cc b/pdns/ws-auth.cc
index 7fb9c6fe3822..a2332109d6d9 100644
--- a/pdns/ws-auth.cc
+++ b/pdns/ws-auth.cc
@@ -101,10 +101,8 @@ static const std::set<uint16_t> atApexTypes = {QType::SOA, QType::DNSKEY};
 static const std::set<uint16_t> nonApexTypes = {QType::DS};
 
 AuthWebServer::AuthWebServer() :
-  d_start(time(nullptr)),
-  d_min10(0),
-  d_min5(0),
-  d_min1(0)
+  d_start(time(nullptr))
+
 {
   if (arg().mustDo("webserver") || arg().mustDo("api")) {
     d_ws = std::make_unique<WebServer>(arg()["webserver-address"], arg().asNum("webserver-port"));
diff --git a/pdns/ws-auth.hh b/pdns/ws-auth.hh
index 4eb539e76544..f456ed37a84b 100644
--- a/pdns/ws-auth.hh
+++ b/pdns/ws-auth.hh
@@ -61,7 +61,7 @@ private:
   void statThread(StatBag& stats);
 
   time_t d_start;
-  double d_min10, d_min5, d_min1;
+  double d_min10{0}, d_min5{0}, d_min1{0};
   Ewma d_queries, d_cachehits, d_cachemisses;
   Ewma d_qcachehits, d_qcachemisses;
   unique_ptr<WebServer> d_ws{nullptr};
diff --git a/pdns/zoneparser-tng.hh b/pdns/zoneparser-tng.hh
index b50e86ec6658..977fcb768210 100644
--- a/pdns/zoneparser-tng.hh
+++ b/pdns/zoneparser-tng.hh
@@ -60,10 +60,11 @@ private:
   unsigned makeTTLFromZone(const std::string& str);
 
   struct filestate {
-    filestate(FILE* fp, string filename) : d_fp(fp), d_filename(std::move(filename)), d_lineno(0){}
+    filestate(FILE* fp, string filename) :
+      d_fp(fp), d_filename(std::move(filename)) {}
     FILE *d_fp;
     string d_filename;
-    int d_lineno;
+    int d_lineno{0};
   };
 
   parts_t d_parts;