diff --git a/src/resolve/resolvectl.c b/src/resolve/resolvectl.c
index 9af5626059..5e51664763 100644
--- a/src/resolve/resolvectl.c
+++ b/src/resolve/resolvectl.c
@@ -1161,6 +1161,9 @@ static int verb_tlsa(int argc, char *argv[], uintptr_t _data, void *userdata) {
         } else
                 args = strv_skip(argv, 1);
 
+        if (strv_isempty(args))
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "The tlsa command requires at least one domain.");
+
         STRV_FOREACH(p, args)
                 RET_GATHER(ret, resolve_tlsa(family, *p));
 
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index 85e9e4cc84..d3a7d38259 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -627,6 +627,8 @@ testcase_08_resolved() {
     grep -qF '"data":"' "$RUN_OUT"
     (! run resolvectl openpgp mr.smith@signed.test --json=short --type=A)
     grep -qF -- "The openpgp command may only be combined with --type=OPENPGPKEY." "$RUN_OUT"
+    (! run resolvectl tlsa tcp)
+    grep -qF -- "The tlsa command requires at least one domain." "$RUN_OUT"
     (! run resolvectl tlsa signed.test:invalid --json=short)
     grep -qF 'Invalid port "invalid".' "$RUN_OUT"
     (! run resolvectl tlsa signed.test --json=short --type=A)