diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
index 9a0e2d5161..394b843544 100644
--- a/src/resolve/resolved-dns-packet.c
+++ b/src/resolve/resolved-dns-packet.c
@@ -160,6 +160,38 @@ int dns_packet_new_query(DnsPacket **ret, DnsProtocol protocol, size_t min_alloc
         return 0;
 }
 
+int dns_packet_dup(DnsPacket **ret, DnsPacket *p) {
+        DnsPacket *c;
+        int r;
+
+        assert(ret);
+        assert(p);
+
+        r = dns_packet_validate(p);
+        if (r < 0)
+                return r;
+
+        c = malloc(ALIGN(sizeof(DnsPacket)) + p->size);
+        if (!c)
+                return -ENOMEM;
+
+        *c = (DnsPacket) {
+                .n_ref = 1,
+                .protocol = p->protocol,
+                .size = p->size,
+                .rindex = DNS_PACKET_HEADER_SIZE,
+                .allocated = p->size,
+                .max_size = p->max_size,
+                .opt_start = (size_t) -1,
+                .opt_size = (size_t) -1,
+        };
+
+        memcpy(DNS_PACKET_DATA(c), DNS_PACKET_DATA(p), p->size);
+
+        *ret = c;
+        return 0;
+}
+
 DnsPacket *dns_packet_ref(DnsPacket *p) {
 
         if (!p)
diff --git a/src/resolve/resolved-dns-packet.h b/src/resolve/resolved-dns-packet.h
index 4dba96b3b8..c33ca8c999 100644
--- a/src/resolve/resolved-dns-packet.h
+++ b/src/resolve/resolved-dns-packet.h
@@ -176,6 +176,8 @@ static inline unsigned DNS_PACKET_RRCOUNT(DnsPacket *p) {
 int dns_packet_new(DnsPacket **p, DnsProtocol protocol, size_t min_alloc_dsize, size_t max_size);
 int dns_packet_new_query(DnsPacket **p, DnsProtocol protocol, size_t min_alloc_dsize, bool dnssec_checking_disabled);
 
+int dns_packet_dup(DnsPacket **ret, DnsPacket *p);
+
 void dns_packet_set_flags(DnsPacket *p, bool dnssec_checking_disabled, bool truncated);
 
 DnsPacket *dns_packet_ref(DnsPacket *p);