diff --git a/configure.ac b/configure.ac
index e54e7fa8f283f8c5b9e03cdbdeccc904e710c470..bf3c4910e051987bcc72e7705bd531fe01a2ef58 100644
--- a/configure.ac
+++ b/configure.ac
@@ -172,6 +172,8 @@ AS_IF([test "$enable_reuseport" = yes],[
AC_DEFINE([ENABLE_REUSEPORT], [1], [Use SO_REUSEPORT.])])
AX_CHECK_COMPILE_FLAG("-fpredictive-commoning", [CFLAGS="$CFLAGS -fpredictive-commoning"], [], "-Werror")
+AX_CHECK_LINK_FLAG(["-Wl,--exclude-libs,ALL"], [ldflag_exclude_libs="-Wl,--exclude-libs,ALL"], [ldflag_exclude_libs=""], "")
+AC_SUBST([LDFLAG_EXCLUDE_LIBS], $ldflag_exclude_libs)
# Default directories
run_dir="${localstatedir}/run/knot"
diff --git a/m4/ax_check_link_flag.m4 b/m4/ax_check_link_flag.m4
new file mode 100644
index 0000000000000000000000000000000000000000..e2d0d363e4c4ac672d36a2c964973136d007be73
--- /dev/null
+++ b/m4/ax_check_link_flag.m4
@@ -0,0 +1,71 @@
+# ===========================================================================
+# http://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+# AX_CHECK_LINK_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS])
+#
+# DESCRIPTION
+#
+# Check whether the given FLAG works with the linker or gives an error.
+# (Warnings, however, are ignored)
+#
+# ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on
+# success/failure.
+#
+# If EXTRA-FLAGS is defined, it is added to the linker's default flags
+# when the check is done. The check is thus made with the flags: "LDFLAGS
+# EXTRA-FLAGS FLAG". This can for example be used to force the linker to
+# issue an error when a bad flag is given.
+#
+# NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this
+# macro in sync with AX_CHECK_{PREPROC,COMPILE}_FLAG.
+#
+# LICENSE
+#
+# Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
+# Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
+#
+# This program is free software: you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation, either version 3 of the License, or (at your
+# option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+# Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+# As a special exception, the respective Autoconf Macro's copyright owner
+# gives unlimited permission to copy, distribute and modify the configure
+# scripts that are the output of Autoconf when processing the Macro. You
+# need not follow the terms of the GNU General Public License when using
+# or distributing such scripts, even though portions of the text of the
+# Macro appear in them. The GNU General Public License (GPL) does govern
+# all other use of the material that constitutes the Autoconf Macro.
+#
+# This special exception to the GPL applies to versions of the Autoconf
+# Macro released by the Autoconf Archive. When you make and distribute a
+# modified version of the Autoconf Macro, you may extend this special
+# exception to the GPL to apply to your modified version as well.
+
+#serial 2
+
+AC_DEFUN([AX_CHECK_LINK_FLAG],
+[AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_ldflags_$4_$1])dnl
+AC_CACHE_CHECK([whether the linker accepts $1], CACHEVAR, [
+ ax_check_save_flags=$LDFLAGS
+ LDFLAGS="$LDFLAGS $4 $1"
+ AC_LINK_IFELSE([AC_LANG_PROGRAM()],
+ [AS_VAR_SET(CACHEVAR,[yes])],
+ [AS_VAR_SET(CACHEVAR,[no])])
+ LDFLAGS=$ax_check_save_flags])
+AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes],
+ [m4_default([$2], :)],
+ [m4_default([$3], :)])
+AS_VAR_POPDEF([CACHEVAR])dnl
+])dnl AX_CHECK_LINK_FLAGS
diff --git a/src/Makefile.am b/src/Makefile.am
index c446d795b1161c61221ddbf57c6867a59e2df8a6..584a61b555f20639d6617d180e267eb96ef7d0f0 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -182,7 +182,7 @@ libknot_la_SOURCES = \
libknot_la_CPPFLAGS = $(AM_CPPFLAGS) $(CFLAG_VISIBILITY) $(lmdb_CFLAGS)
libknot_la_CFLAGS = $(AM_CFLAGS)
-libknot_la_LDFLAGS = $(AM_LDFLAGS) $(libknot_VERSION_INFO) $(lmdb_LIBS)
+libknot_la_LDFLAGS = $(AM_LDFLAGS) $(libknot_VERSION_INFO) $(lmdb_LIBS) $(LDFLAG_EXCLUDE_LIBS)
libknot_la_LIBADD = dnssec/libdnssec.la libcontrib.la
# pkg-config
@@ -445,7 +445,7 @@ keymgr_CPPFLAGS = $(AM_CPPFLAGS) -I$(srcdir)/dnssec/lib/dnssec -I$(srcdir)/dnsse
keymgr_LDADD = libknotd.la libknotus.la dnssec/libdnssec.la dnssec/libshared.la \
zscanner/libzscanner.la $(gnutls_LIBS)
knotd_CPPFLAGS = $(AM_CPPFLAGS) $(liburcu_CFLAGS)
-knotd_LDADD = libknotd.la $(liburcu_LIBS)
+knotd_LDADD = libknotd.la libcontrib.la $(liburcu_LIBS)
knotc_CPPFLAGS = $(AM_CPPFLAGS) $(libedit_CFLAGS)
knotc_LDADD = libknotd.la libknotus.la $(libedit_LIBS)
knot1to2_LDADD = libcontrib.la
@@ -531,9 +531,9 @@ knsupdate_CPPFLAGS = $(AM_CPPFLAGS) $(gnutls_CFLAGS)
knsupdate_LDADD = zscanner/libzscanner.la libknotus.la
knsec3hash_CPPFLAGS = $(AM_CPPFLAGS) -I$(srcdir)/dnssec/lib/dnssec -I$(srcdir)/dnssec
knsec3hash_LDADD = dnssec/libdnssec.la dnssec/libshared.la
-kzonecheck_LDADD = libknotd.la
+kzonecheck_LDADD = libknotd.la libcontrib.la
kjournalprint_CPPFLAGS = $(AM_CPPFLAGS) $(gnutls_CFLAGS)
-kjournalprint_LDADD = $(libidn_LIBS) libknotd.la
+kjournalprint_LDADD = $(libidn_LIBS) libknotd.la libcontrib.la
#######################################
# Optional Knot DNS Utilities modules #
@@ -549,7 +549,7 @@ endif # HAVE_DNSTAP
if HAVE_ROSEDB
bin_PROGRAMS += rosedb_tool
rosedb_tool_SOURCES = knot/modules/rosedb_tool.c
-rosedb_tool_LDADD = libknotd.la
+rosedb_tool_LDADD = libknotd.la libcontrib.la
rosedb_tool_CFLAGS = $(AM_CFLAGS) $(lmdb_CFLAGS) $(DNSTAP_CFLAGS)
rosedb_tool_LDFLAGS = $(AM_LDFLAGS) $(lmdb_LIBS)
endif # HAVE_ROSEDB
diff --git a/tests-fuzz/Makefile.am b/tests-fuzz/Makefile.am
index 992c87bfd7144960c79b532f332b70e89904080d..b6eb1a30f37eba94da8b90a775e9d122aaa0fb65 100644
--- a/tests-fuzz/Makefile.am
+++ b/tests-fuzz/Makefile.am
@@ -19,6 +19,7 @@ knotd_stdio_SOURCES = wrap/server.c wrap/tcp-handler.c wrap/udp-handler.c
knotd_stdio_CPPFLAGS = $(AM_CPPFLAGS) $(liburcu_CFLAGS)
knotd_stdio_LDADD = \
$(top_builddir)/src/utils/knotd/knotd-main.o \
- $(top_builddir)/src/libknotd.la $(liburcu_LIBS)
+ $(top_builddir)/src/libknotd.la $(top_builddir)/src/libcontrib.la \
+ $(liburcu_LIBS)
check-compile: $(check_PROGRAMS)
diff --git a/tests/Makefile.am b/tests/Makefile.am
index ab2bef9c534d7381242670b2ae930d2aab4cde5b..5e08bdb9e44a3c7955d088c7a5d30eec26586aa9 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -8,6 +8,7 @@ LDADD = \
$(top_builddir)/libtap/libtap.la \
$(top_builddir)/src/libknot.la \
$(top_builddir)/src/libknotd.la \
+ $(top_builddir)/src/libcontrib.la \
$(libcrypto_LIBS)
check_PROGRAMS = \