diff --git a/src/libsystemd-network/ndisc-option.c b/src/libsystemd-network/ndisc-option.c
index 1071d98b19..d784ffb3ff 100644
--- a/src/libsystemd-network/ndisc-option.c
+++ b/src/libsystemd-network/ndisc-option.c
@@ -1358,6 +1358,11 @@ static int ndisc_option_parse_encrypted_dns(Set **options, size_t offset, size_t
         r = ndisc_get_dns_name(opt + off, ilen, &res.auth_name);
         if (r < 0)
                 return r;
+        r = dns_name_is_valid_ldh(res.auth_name);
+        if (r < 0)
+                return r;
+        if (!r)
+                return -EBADMSG;
         if (dns_name_is_root(res.auth_name))
                 return -EBADMSG;
         off += ilen;
diff --git a/src/libsystemd-network/sd-dhcp-lease.c b/src/libsystemd-network/sd-dhcp-lease.c
index 1c0cd6829b..fc891a0b04 100644
--- a/src/libsystemd-network/sd-dhcp-lease.c
+++ b/src/libsystemd-network/sd-dhcp-lease.c
@@ -628,6 +628,11 @@ static int lease_parse_dnr(const uint8_t *option, size_t len, sd_dns_resolver **
                 r = lease_parse_dns_name(option + offset, ilen, &res.auth_name);
                 if (r < 0)
                         return r;
+                r = dns_name_is_valid_ldh(res.auth_name);
+                if (r < 0)
+                        return r;
+                if (!r)
+                        return -EBADMSG;
                 if (dns_name_is_root(res.auth_name))
                         return -EBADMSG;
                 offset += ilen;
@@ -1551,7 +1556,8 @@ int dhcp_lease_load(sd_dhcp_lease **ret, const char *lease_file) {
                 r = deserialize_dnr(&lease->dnr, dnr);
                 if (r < 0)
                         log_debug_errno(r, "Failed to deserialize DNR servers %s, ignoring: %m", dnr);
-                lease->n_dnr = r;
+                else
+                        lease->n_dnr = r;
         }
 
         if (ntp) {
diff --git a/src/libsystemd-network/sd-dhcp6-lease.c b/src/libsystemd-network/sd-dhcp6-lease.c
index bc054c42b2..2ff1e87a2e 100644
--- a/src/libsystemd-network/sd-dhcp6-lease.c
+++ b/src/libsystemd-network/sd-dhcp6-lease.c
@@ -8,6 +8,7 @@
 #include "alloc-util.h"
 #include "dhcp6-internal.h"
 #include "dhcp6-lease-internal.h"
+#include "dns-domain.h"
 #include "network-common.h"
 #include "sort-util.h"
 #include "strv.h"
@@ -465,6 +466,11 @@ static int dhcp6_lease_add_dnr(sd_dhcp6_lease *lease, const uint8_t *optval, siz
         r = dhcp6_option_parse_domainname(optval + offset, ilen, &res.auth_name);
         if (r < 0)
                 return r;
+        r = dns_name_is_valid_ldh(res.auth_name);
+        if (r < 0)
+                return r;
+        if (!r)
+                return -EBADMSG;
         offset += ilen;
 
         /* RFC9463 § 3.1.6: adn only mode */
diff --git a/test/fuzz/fuzz-dhcp-client/dnr_invalid b/test/fuzz/fuzz-dhcp-client/dnr_invalid
new file mode 100644
index 0000000000..a988fba046
Binary files /dev/null and b/test/fuzz/fuzz-dhcp-client/dnr_invalid differ