diff --git a/man/systemd-resolved.service.xml b/man/systemd-resolved.service.xml
index 13c0da987fe..f7be0793cf5 100644
--- a/man/systemd-resolved.service.xml
+++ b/man/systemd-resolved.service.xml
@@ -219,8 +219,9 @@
is sent to all DNS servers that are configured on links with the DefaultRoute=
option set, as well as the globally configured DNS server.
- If there is no link configured as DefaultRoute= and no global DNS
- server configured, one of the compiled-in fallback DNS servers is used.
+ If there are no DNS servers configured on any link also configured as
+ DefaultRoute= and no global DNS server configured, one of the compiled-in fallback
+ DNS servers is used.
Otherwise the unicast DNS query fails, as no suitable DNS servers can be determined.
diff --git a/src/resolve/resolved-dns-scope.c b/src/resolve/resolved-dns-scope.c
index 21b9844e047..4d4e952dac4 100644
--- a/src/resolve/resolved-dns-scope.c
+++ b/src/resolve/resolved-dns-scope.c
@@ -778,6 +778,10 @@ DnsScopeMatch dns_scope_good_domain(
if (!dns_scope_is_default_route(s))
return DNS_SCOPE_NO;
+ /* Prefer suitable per-link scopes where possible */
+ if (dns_server_is_fallback(dns_scope_get_dns_server(s)))
+ return DNS_SCOPE_LAST_RESORT;
+
return DNS_SCOPE_MAYBE;
}