diff --git a/src/resolve/test-dns-synthesize.c b/src/resolve/test-dns-synthesize.c
index 64b79df45eb..7d55e18793b 100644
--- a/src/resolve/test-dns-synthesize.c
+++ b/src/resolve/test-dns-synthesize.c
@@ -302,4 +302,25 @@ TEST(dns_synthesize_answer_address_local_dns_proxy) {
         ASSERT_TRUE(dns_answer_contains(answer, rr));
 }
 
+TEST(dns_synthesize_answer_onion) {
+        Manager manager = {};
+        int type;
+
+        FOREACH_ARGUMENT(type, DNS_TYPE_A, DNS_TYPE_TXT) {
+                _cleanup_(dns_question_unrefp) DnsQuestion *question = NULL;
+                _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
+                _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
+
+                question = dns_question_new(1);
+                ASSERT_NOT_NULL(question);
+
+                key = dns_resource_key_new(DNS_CLASS_IN, type, "mysecret.onion");
+                ASSERT_NOT_NULL(key);
+                ASSERT_OK(dns_question_add(question, key, 0));
+
+                ASSERT_ERROR(dns_synthesize_answer(&manager, question, 0, &answer), ENXIO);
+                ASSERT_NULL(answer);
+        }
+}
+
 DEFINE_TEST_MAIN(LOG_DEBUG);
diff --git a/src/shared/dns-domain.c b/src/shared/dns-domain.c
index c90da5fc465..de8d261d0b0 100644
--- a/src/shared/dns-domain.c
+++ b/src/shared/dns-domain.c
@@ -1368,6 +1368,10 @@ bool dns_name_dont_resolve(const char *name) {
         if (dns_name_endswith(name, "invalid") > 0)
                 return true;
 
+        /* Never respond to the domains listed in RFC7686 */
+        if (dns_name_endswith(name, "onion") > 0)
+                return true;
+
         /* Never respond to some of the domains listed in RFC9476 */
         if (dns_name_endswith(name, "alt") > 0)
                 return true;
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index e7dcf59ec2a..ba9fd44a17c 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -512,6 +512,7 @@ testcase_07_22229() {
         "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
         "hello.invalid"
         "hello.alt"
+        "hello.onion"
     )
 
     for name in "${FILTERED_NAMES[@]}"; do