diff --git a/apps/emqx/src/emqx_connection.erl b/apps/emqx/src/emqx_connection.erl
index 66160ed36..fd7ce4148 100644
--- a/apps/emqx/src/emqx_connection.erl
+++ b/apps/emqx/src/emqx_connection.erl
@@ -979,7 +979,7 @@ handle_cast(Req, State) ->
 %% rate limit
 
 -type limiter_type() :: emqx_limiter_container:limiter_type().
--type limiter() :: emqx_limiter_container:limiter().
+-type limiter() :: emqx_limiter_container:container().
 -type check_succ_handler() ::
     fun((any(), list(any()), state()) -> _).
 
diff --git a/apps/emqx/src/emqx_hocon.erl b/apps/emqx/src/emqx_hocon.erl
index 68594ad9d..56ac6463f 100644
--- a/apps/emqx/src/emqx_hocon.erl
+++ b/apps/emqx/src/emqx_hocon.erl
@@ -138,7 +138,7 @@ compact_errors(SchemaModule, Error, Stacktrace) ->
     }}.
 
 %% @doc This is only used in static check scripts in the CI.
--spec load_and_check(module(), filename:filename_all()) -> {ok, term()} | {error, any()}.
+-spec load_and_check(module(), file:name_all()) -> {ok, term()} | {error, any()}.
 load_and_check(SchemaModule, File) ->
     try
         do_load_and_check(SchemaModule, File)
diff --git a/apps/emqx/src/emqx_hookpoints.erl b/apps/emqx/src/emqx_hookpoints.erl
index ba125101e..31861b421 100644
--- a/apps/emqx/src/emqx_hookpoints.erl
+++ b/apps/emqx/src/emqx_hookpoints.erl
@@ -125,12 +125,12 @@ when
 -callback 'client.subscribe'(emqx_types:clientinfo(), emqx_types:properties(), TopicFilters) ->
     fold_callback_result(TopicFilters)
 when
-    TopicFilters :: list({emqx_topic:topic(), map()}).
+    TopicFilters :: list({emqx_types:topic(), map()}).
 
 -callback 'client.unsubscribe'(emqx_types:clientinfo(), emqx_types:properties(), TopicFilters) ->
     fold_callback_result(TopicFilters)
 when
-    TopicFilters :: list({emqx_topic:topic(), map()}).
+    TopicFilters :: list({emqx_types:topic(), map()}).
 
 -callback 'client.timeout'(_TimerReference :: reference(), _Msg :: term(), Replies) ->
     fold_callback_result(Replies)
diff --git a/apps/emqx/src/emqx_limiter/src/emqx_htb_limiter.erl b/apps/emqx/src/emqx_limiter/src/emqx_htb_limiter.erl
index 15e838b6e..d53819e90 100644
--- a/apps/emqx/src/emqx_limiter/src/emqx_htb_limiter.erl
+++ b/apps/emqx/src/emqx_limiter/src/emqx_htb_limiter.erl
@@ -32,7 +32,7 @@
     make_future/1,
     available/1
 ]).
--export_type([local_limiter/0, limiter/0]).
+-export_type([local_limiter/0, limiter/0, retry_context/1]).
 
 %% a token bucket limiter which may or not contains a reference to another limiter,
 %% and can be used in a client alone
diff --git a/apps/emqx/src/emqx_limiter/src/emqx_limiter_bucket_ref.erl b/apps/emqx/src/emqx_limiter/src/emqx_limiter_bucket_ref.erl
index 139564df7..873f70db7 100644
--- a/apps/emqx/src/emqx_limiter/src/emqx_limiter_bucket_ref.erl
+++ b/apps/emqx/src/emqx_limiter/src/emqx_limiter_bucket_ref.erl
@@ -51,7 +51,7 @@
 %%--------------------------------------------------------------------
 %%  API
 %%--------------------------------------------------------------------
--spec new(counters:countres_ref(), index(), rate()) -> bucket_ref().
+-spec new(counters:counters_ref(), index(), rate()) -> bucket_ref().
 new(Counter, Index, Rate) ->
     #{
         counter => Counter,
diff --git a/apps/emqx/src/emqx_limiter/src/emqx_limiter_container.erl b/apps/emqx/src/emqx_limiter/src/emqx_limiter_container.erl
index fb97a9b67..0823a10d7 100644
--- a/apps/emqx/src/emqx_limiter/src/emqx_limiter_container.erl
+++ b/apps/emqx/src/emqx_limiter/src/emqx_limiter_container.erl
@@ -32,7 +32,7 @@
     retry_list/2
 ]).
 
--export_type([container/0, check_result/0]).
+-export_type([limiter/0, container/0, check_result/0, limiter_type/0]).
 
 -type container() ::
     infinity
@@ -51,7 +51,7 @@
 -type limiter_id() :: emqx_limiter_schema:limiter_id().
 -type limiter_type() :: emqx_limiter_schema:limiter_type().
 -type limiter() :: emqx_htb_limiter:limiter().
--type retry_context() :: emqx_htb_limiter:retry_context().
+-type retry_context() :: emqx_htb_limiter:retry_context(limiter()).
 -type millisecond() :: non_neg_integer().
 -type check_result() ::
     {ok, container()}
diff --git a/apps/emqx/src/emqx_listeners.erl b/apps/emqx/src/emqx_listeners.erl
index 9abff250b..5cf631ccb 100644
--- a/apps/emqx/src/emqx_listeners.erl
+++ b/apps/emqx/src/emqx_listeners.erl
@@ -63,6 +63,8 @@
 -export([certs_dir/2]).
 -endif.
 
+-export_type([listener_id/0]).
+
 -type listener_id() :: atom() | binary().
 -define(ROOT_KEY, listeners).
 -define(CONF_KEY_PATH, [?ROOT_KEY, '?', '?']).
diff --git a/apps/emqx/src/emqx_metrics.erl b/apps/emqx/src/emqx_metrics.erl
index ee86457b0..40427c192 100644
--- a/apps/emqx/src/emqx_metrics.erl
+++ b/apps/emqx/src/emqx_metrics.erl
@@ -72,7 +72,7 @@
 %% BACKW: v4.3.0
 -export([upgrade_retained_delayed_counter_type/0]).
 
--export_type([metric_idx/0]).
+-export_type([metric_idx/0, metric_name/0]).
 
 -compile({inline, [inc/1, inc/2, dec/1, dec/2]}).
 -compile({inline, [inc_recv/1, inc_sent/1]}).
@@ -438,7 +438,7 @@ update_counter(Name, Value) ->
 %% Inc received/sent metrics
 %%--------------------------------------------------------------------
 
--spec inc_msg(emqx_types:massage()) -> ok.
+-spec inc_msg(emqx_types:message()) -> ok.
 inc_msg(Msg) ->
     case Msg#message.qos of
         0 -> inc('messages.qos0.received');
diff --git a/apps/emqx/src/emqx_persistent_session_ds.erl b/apps/emqx/src/emqx_persistent_session_ds.erl
index 37385c12c..a1db2e933 100644
--- a/apps/emqx/src/emqx_persistent_session_ds.erl
+++ b/apps/emqx/src/emqx_persistent_session_ds.erl
@@ -85,6 +85,12 @@
 ]).
 -endif.
 
+-export_type([
+    id/0,
+    subscription_id/0,
+    session/0
+]).
+
 %% Currently, this is the clientid.  We avoid `emqx_types:clientid()' because that can be
 %% an atom, in theory (?).
 -type id() :: binary().
@@ -145,8 +151,6 @@
         (NOW_MS >= LAST_ALIVE_AT + EI))
 ).
 
--export_type([id/0]).
-
 %%
 
 -spec create(clientinfo(), conninfo(), emqx_session:conf()) ->
@@ -243,7 +247,7 @@ stats(Session) ->
     info(?STATS_KEYS, Session).
 
 %% Debug/troubleshooting
--spec print_session(emqx_types:client_id()) -> map() | undefined.
+-spec print_session(emqx_types:clientid()) -> map() | undefined.
 print_session(ClientId) ->
     catch ro_transaction(
         fun() ->
diff --git a/apps/emqx/src/emqx_persistent_session_ds/emqx_ps_ds_int.hrl b/apps/emqx/src/emqx_persistent_session_ds/emqx_ps_ds_int.hrl
index 30820b126..cb6296b59 100644
--- a/apps/emqx/src/emqx_persistent_session_ds/emqx_ps_ds_int.hrl
+++ b/apps/emqx/src/emqx_persistent_session_ds/emqx_ps_ds_int.hrl
@@ -24,7 +24,7 @@
     dest :: emqx_persistent_session_ds:id()
 }).
 -record(ps_routeidx, {
-    entry :: emqx_topic_index:key(emqx_persistent_session_ds_router:dest()),
+    entry :: '$1' | emqx_topic_index:key(emqx_persistent_session_ds_router:dest()),
     unused = [] :: nil()
 }).
 
diff --git a/apps/emqx/src/emqx_router.erl b/apps/emqx/src/emqx_router.erl
index 1aebb1b21..3b92d4f1c 100644
--- a/apps/emqx/src/emqx_router.erl
+++ b/apps/emqx/src/emqx_router.erl
@@ -91,7 +91,7 @@
 -type dest() :: node() | {group(), node()}.
 
 -record(routeidx, {
-    entry :: emqx_topic_index:key(dest()),
+    entry :: '$1' | emqx_topic_index:key(dest()),
     unused = [] :: nil()
 }).
 
diff --git a/apps/emqx/src/emqx_session.erl b/apps/emqx/src/emqx_session.erl
index fa9469a61..c08109fe8 100644
--- a/apps/emqx/src/emqx_session.erl
+++ b/apps/emqx/src/emqx_session.erl
@@ -111,6 +111,7 @@
     t/0,
     conf/0,
     conninfo/0,
+    clientinfo/0,
     reply/0,
     replies/0,
     common_timer_name/0,
@@ -499,7 +500,7 @@ cancel_timer(Name, Timers0) ->
 
 %%--------------------------------------------------------------------
 
--spec disconnect(clientinfo(), eqmx_types:conninfo(), t()) ->
+-spec disconnect(clientinfo(), conninfo(), t()) ->
     {idle | shutdown, t()}.
 disconnect(_ClientInfo, ConnInfo, Session) ->
     ?IMPL(Session):disconnect(Session, ConnInfo).
diff --git a/apps/emqx/src/emqx_session_events.erl b/apps/emqx/src/emqx_session_events.erl
index b04dd2044..f46144020 100644
--- a/apps/emqx/src/emqx_session_events.erl
+++ b/apps/emqx/src/emqx_session_events.erl
@@ -34,7 +34,7 @@
 
 %%
 
--spec handle_event(emqx_session:client_info(), event()) ->
+-spec handle_event(emqx_session:clientinfo(), event()) ->
     ok.
 handle_event(ClientInfo, {expired, Msg}) ->
     ok = emqx_hooks:run('delivery.dropped', [ClientInfo, Msg, expired]),
diff --git a/apps/emqx/src/emqx_sup.erl b/apps/emqx/src/emqx_sup.erl
index 65742a234..24314362c 100644
--- a/apps/emqx/src/emqx_sup.erl
+++ b/apps/emqx/src/emqx_sup.erl
@@ -30,8 +30,8 @@
 -export([init/1]).
 
 -type startchild_ret() ::
-    {ok, supervisor:child()}
-    | {ok, supervisor:child(), term()}
+    {ok, pid()}
+    | {ok, pid(), term()}
     | {error, term()}.
 
 -define(SUP, ?MODULE).
@@ -52,7 +52,7 @@ start_child(ChildSpec) when is_map(ChildSpec) ->
 start_child(Mod, Type) ->
     start_child(child_spec(Mod, Type)).
 
--spec stop_child(supervisor:child_id()) -> ok | {error, term()}.
+-spec stop_child(atom()) -> ok | {error, term()}.
 stop_child(ChildId) ->
     case supervisor:terminate_child(?SUP, ChildId) of
         ok -> supervisor:delete_child(?SUP, ChildId);
diff --git a/apps/emqx/src/emqx_tls_lib.erl b/apps/emqx/src/emqx_tls_lib.erl
index 0b9bfe805..32c572b42 100644
--- a/apps/emqx/src/emqx_tls_lib.erl
+++ b/apps/emqx/src/emqx_tls_lib.erl
@@ -44,6 +44,9 @@
     to_client_opts/2
 ]).
 
+%% ssl:tls_version/0 is not exported.
+-type tls_version() :: tlsv1 | 'tlsv1.1' | 'tlsv1.2' | 'tlsv1.3'.
+
 -include("logger.hrl").
 
 -define(IS_TRUE(Val), ((Val =:= true) orelse (Val =:= <<"true">>))).
@@ -123,8 +126,8 @@
 %% @doc Validate a given list of desired tls versions.
 %% raise an error exception if non of them are available.
 %% The input list can be a string/binary of comma separated versions.
--spec integral_versions(tls | dtls, undefined | string() | binary() | [ssl:tls_version()]) ->
-    [ssl:tls_version()].
+-spec integral_versions(tls | dtls, undefined | string() | binary() | [tls_version()]) ->
+    [tls_version()].
 integral_versions(Type, undefined) ->
     available_versions(Type);
 integral_versions(Type, []) ->
@@ -164,7 +167,7 @@ all_ciphers() ->
     all_ciphers(available_versions(all)).
 
 %% @hidden Return a list of (openssl string format) cipher suites.
--spec all_ciphers([ssl:tls_version()]) -> [string()].
+-spec all_ciphers([tls_version()]) -> [string()].
 all_ciphers(['tlsv1.3']) ->
     %% When it's only tlsv1.3 wanted, use 'exclusive' here
     %% because 'all' returns legacy cipher suites too,
@@ -212,7 +215,7 @@ do_selected_ciphers(_) ->
     ?SELECTED_CIPHERS.
 
 %% @doc Ensure version & cipher-suites integrity.
--spec integral_ciphers([ssl:tls_version()], binary() | string() | [string()]) -> [string()].
+-spec integral_ciphers([tls_version()], binary() | string() | [string()]) -> [string()].
 integral_ciphers(Versions, Ciphers) when Ciphers =:= [] orelse Ciphers =:= undefined ->
     %% not configured
     integral_ciphers(Versions, selected_ciphers(Versions));
diff --git a/apps/emqx/src/emqx_tls_psk.erl b/apps/emqx/src/emqx_tls_psk.erl
index 871c41368..1041e6ee0 100644
--- a/apps/emqx/src/emqx_tls_psk.erl
+++ b/apps/emqx/src/emqx_tls_psk.erl
@@ -20,6 +20,7 @@
 
 %% SSL PSK Callbacks
 -export([lookup/3]).
+-export_type([psk_identity/0]).
 
 -type psk_identity() :: string().
 -type psk_user_state() :: term().
diff --git a/apps/emqx/src/emqx_topic_index.erl b/apps/emqx/src/emqx_topic_index.erl
index eaedb2e53..acf10c11c 100644
--- a/apps/emqx/src/emqx_topic_index.erl
+++ b/apps/emqx/src/emqx_topic_index.erl
@@ -30,6 +30,8 @@
 -export([get_topic/1]).
 -export([get_record/2]).
 
+-export_type([key/1]).
+
 -type key(ID) :: emqx_trie_search:key(ID).
 -type match(ID) :: key(ID).
 -type words() :: emqx_trie_search:words().
diff --git a/apps/emqx/src/emqx_trace/emqx_trace_formatter.erl b/apps/emqx/src/emqx_trace/emqx_trace_formatter.erl
index ae2596808..49b7e9890 100644
--- a/apps/emqx/src/emqx_trace/emqx_trace_formatter.erl
+++ b/apps/emqx/src/emqx_trace/emqx_trace_formatter.erl
@@ -19,11 +19,14 @@
 -export([format/2]).
 -export([format_meta_map/1]).
 
+%% logger_formatter:config/0 is not exported.
+-type config() :: map().
+
 %%%-----------------------------------------------------------------
 %%% API
 -spec format(LogEvent, Config) -> unicode:chardata() when
     LogEvent :: logger:log_event(),
-    Config :: logger:config().
+    Config :: config().
 format(
     #{level := debug, meta := Meta = #{trace_tag := Tag}, msg := Msg},
     #{payload_encode := PEncode}
diff --git a/apps/emqx/src/emqx_trace/emqx_trace_handler.erl b/apps/emqx/src/emqx_trace/emqx_trace_handler.erl
index 528bc4d42..dcb9ce0c9 100644
--- a/apps/emqx/src/emqx_trace/emqx_trace_handler.erl
+++ b/apps/emqx/src/emqx_trace/emqx_trace_handler.erl
@@ -125,7 +125,7 @@ uninstall(HandlerId) ->
             name => binary(),
             type => topic | clientid | ip_address,
             id => atom(),
-            filter => emqx_types:topic() | emqx_types:clienetid() | emqx_trace:ip_address(),
+            filter => emqx_types:topic() | emqx_types:clientid() | emqx_trace:ip_address(),
             level => logger:level(),
             dst => file:filename() | console | unknown
         }
diff --git a/apps/emqx_durable_storage/src/emqx_ds.erl b/apps/emqx_durable_storage/src/emqx_ds.erl
index 4516a3c86..1d18c5d73 100644
--- a/apps/emqx_durable_storage/src/emqx_ds.erl
+++ b/apps/emqx_durable_storage/src/emqx_ds.erl
@@ -42,6 +42,7 @@
     stream/0,
     stream_rank/0,
     iterator/0,
+    iterator_id/0,
     message_id/0,
     message_store_opts/0,
     next_result/1, next_result/0,
@@ -67,6 +68,9 @@
 
 -type stream_rank() :: {term(), integer()}.
 
+%% TODO: Not implemented
+-type iterator_id() :: term().
+
 -opaque iterator() :: ds_specific_iterator().
 
 -opaque stream() :: ds_specific_stream().
diff --git a/apps/emqx_machine/src/emqx_machine.app.src b/apps/emqx_machine/src/emqx_machine.app.src
index e3b37fc23..6d7012313 100644
--- a/apps/emqx_machine/src/emqx_machine.app.src
+++ b/apps/emqx_machine/src/emqx_machine.app.src
@@ -6,13 +6,7 @@
     {vsn, "0.2.17"},
     {modules, []},
     {registered, []},
-    {applications, [kernel, stdlib, emqx_ctl, covertool]},
-    %% system_monitor is loaded but not booted,
-    %% emqx_machine.erl makes the decision when to start
-    %% the app after certain config injection.
-    %% it's a included_application because otherwise dialyzer
-    %% would report unknown functions
-    {included_applications, [system_monitor]},
+    {applications, [kernel, stdlib, emqx_ctl]},
     {mod, {emqx_machine_app, []}},
     {env, []},
     {licenses, ["Apache-2.0"]},
diff --git a/rebar.config.erl b/rebar.config.erl
index 7ab693979..6958ad784 100644
--- a/rebar.config.erl
+++ b/rebar.config.erl
@@ -562,7 +562,8 @@ dialyzer(Config) ->
     AppsToExclude = AppNames -- KnownApps,
 
     Extra =
-        [bcrypt || provide_bcrypt_dep()] ++
+        [os_mon, system_monitor, covertool] ++
+            [bcrypt || provide_bcrypt_dep()] ++
             [jq || is_jq_supported()] ++
             [quicer || is_quicer_supported()],
     NewDialyzerConfig =