diff --git a/man/resolvectl.xml b/man/resolvectl.xml
index b7a28b47bb..e908345d48 100644
--- a/man/resolvectl.xml
+++ b/man/resolvectl.xml
@@ -482,6 +482,10 @@
         types: SSHFP, TLSA, OPENPGPKEY where this dumps the key material only; and A, AAAA where
         this dumps the address data.</para>
 
+        <para>This option may only be used with <option>--type=</option> or an RFC 4501
+        <literal>dns:</literal> URI, which both perform DNS resource record lookups. It may not be combined
+        with regular hostname or address lookups.</para>
+
         <xi:include href="version-info.xml" xpointer="v239"/></listitem>
       </varlistentry>
 
diff --git a/src/resolve/resolvectl.c b/src/resolve/resolvectl.c
index d77ae3d631..be596841a6 100644
--- a/src/resolve/resolvectl.c
+++ b/src/resolve/resolvectl.c
@@ -894,6 +894,10 @@ static int verb_query(int argc, char *argv[], uintptr_t _data, void *userdata) {
                                 int family, ifindex;
                                 union in_addr_union a;
 
+                                if (arg_raw != RAW_NONE)
+                                        return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                                               "--raw may only be combined with --type= or dns: URIs.");
+
                                 r = in_addr_ifindex_from_string_auto(*p, &family, &a, &ifindex);
                                 if (r >= 0)
                                         RET_GATHER(ret, resolve_address(family, &a, ifindex));
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index 9f18f3dcf3..707a6f3011 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -565,6 +565,10 @@ testcase_08_resolved() {
     run resolvectl query signed.test
     grep -qF "signed.test: 10.0.0.10" "$RUN_OUT"
     grep -qF "authenticated: yes" "$RUN_OUT"
+    (! run resolvectl --raw query localhost)
+    grep -qF -- "--raw may only be combined with --type= or dns: URIs." "$RUN_OUT"
+    resolvectl --raw=packet query --type=A signed.test >"$RUN_OUT"
+    test -s "$RUN_OUT"
     run dig @ns1.unsigned.test +short MX signed.test
     grep -qF "10 mail.signed.test." "$RUN_OUT"
     run resolvectl query --legend=no -t MX signed.test