diff --git a/NEWS b/NEWS
index ccadaa256d..c5686b929f 100644
--- a/NEWS
+++ b/NEWS
@@ -454,6 +454,9 @@ CHANGES WITH 261:
 
         Changes in systemd-resolved:
 
+        * The resolvconf compatibility mode now rejects malformed stdin input
+          and leaves the existing per-link DNS configuration unchanged.
+
         * systemd-resolved will now read additional DNS resource record
           definitions to resolve locally from JSON drop-in files in
           {/etc,/run,/usr/local/lib,/usr/lib}/systemd/resolve/static.d/. This
diff --git a/man/resolvectl.xml b/man/resolvectl.xml
index e908345d48..fabd64e81e 100644
--- a/man/resolvectl.xml
+++ b/man/resolvectl.xml
@@ -564,7 +564,8 @@
         DNS configuration data from its standard input. Relevant fields are <literal>nameserver</literal> and
         <literal>domain</literal>/<literal>search</literal>. This command is mostly identical to invoking
         <command>resolvectl</command> with a combination of <option>dns</option> and <option>domain</option>
-        commands.</para>
+        commands. If a relevant input line has invalid syntax, the command fails and leaves the existing
+        per-interface configuration unchanged.</para>
 
         <xi:include href="version-info.xml" xpointer="v239"/></listitem>
       </varlistentry>
diff --git a/src/resolve/resolvconf-compat.c b/src/resolve/resolvconf-compat.c
index d3ddec755a..dcac5c130e 100644
--- a/src/resolve/resolvconf-compat.c
+++ b/src/resolve/resolvconf-compat.c
@@ -116,7 +116,9 @@ static int parse_stdin(LookupType lookup_type) {
 
                 a = first_word(line, "nameserver");
                 if (a) {
-                        (void) parse_nameserver(a);
+                        r = parse_nameserver(a);
+                        if (r < 0)
+                                return log_error_errno(r, "Failed to parse resolv.conf nameserver line: %m");
                         continue;
                 }
 
@@ -124,7 +126,9 @@ static int parse_stdin(LookupType lookup_type) {
                 if (!a)
                         a = first_word(line, "search");
                 if (a) {
-                        (void) parse_search_domain(a);
+                        r = parse_search_domain(a);
+                        if (r < 0)
+                                return log_error_errno(r, "Failed to parse resolv.conf domain/search line: %m");
                         continue;
                 }
 
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index 707a6f3011..e3055616cb 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -273,6 +273,9 @@ manual_testcase_01_resolvectl() {
     assert_in 'test-domain1.example.com' "$(resolvectl domain hoge)"
     assert_in 'test-domain2.example.com' "$(resolvectl domain hoge)"
     assert_in 'test-search-domain.example.com' "$(resolvectl domain hoge)"
+    resolvectl domain hoge keep.example
+    (! echo -e "nameserver 10.0.2.1\nsearch \"unterminated" | SYSTEMD_INVOKED_AS=resolvconf resolvectl -a hoge)
+    assert_in 'keep.example' "$(resolvectl domain hoge)"
 
     # Tests for 'resolvconf -x'
     echo nameserver 10.0.2.1 | SYSTEMD_INVOKED_AS=resolvconf resolvectl -x -a hoge