diff --git a/TODO b/TODO
index 93f0500680..74183b5f47 100644
--- a/TODO
+++ b/TODO
@@ -32,8 +32,6 @@ Features:
 * replace all canonicalize_file_name() invocations by chase_symlinks(), in
   particulr those where a rootdir is relevant.
 
-* add parse_ip_port() or so, that is like safe_atou16() but checks for != 0
-
 * drop nss-myhostname in favour of nss-resolve?
 
 * drop internal dlopen() based nss-dns fallback in nss-resolve, and rely on the
diff --git a/src/basic/parse-util.c b/src/basic/parse-util.c
index c98815b9bc..6e58ced6f5 100644
--- a/src/basic/parse-util.c
+++ b/src/basic/parse-util.c
@@ -574,3 +574,19 @@ int parse_nice(const char *p, int *ret) {
         *ret = n;
         return 0;
 }
+
+int parse_ip_port(const char *s, uint16_t *ret) {
+        uint16_t l;
+        int r;
+
+        r = safe_atou16(s, &l);
+        if (r < 0)
+                return r;
+
+        if (l == 0)
+                return -EINVAL;
+
+        *ret = (uint16_t) l;
+
+        return 0;
+}
diff --git a/src/basic/parse-util.h b/src/basic/parse-util.h
index 461e1cd4d8..4d132f0de5 100644
--- a/src/basic/parse-util.h
+++ b/src/basic/parse-util.h
@@ -110,3 +110,5 @@ int parse_percent_unbounded(const char *p);
 int parse_percent(const char *p);
 
 int parse_nice(const char *p, int *ret);
+
+int parse_ip_port(const char *s, uint16_t *ret);
diff --git a/src/network/netdev/vxlan.c b/src/network/netdev/vxlan.c
index 10c892b044..231f5cb442 100644
--- a/src/network/netdev/vxlan.c
+++ b/src/network/netdev/vxlan.c
@@ -252,8 +252,8 @@ int config_parse_destination_port(const char *unit,
         assert(rvalue);
         assert(data);
 
-        r = safe_atou16(rvalue, &port);
-        if (r < 0 || port <= 0) {
+        r = parse_ip_port(rvalue, &port);
+        if (r < 0) {
                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse VXLAN destination port '%s'.", rvalue);
                 return 0;
         }
diff --git a/src/nspawn/nspawn-expose-ports.c b/src/nspawn/nspawn-expose-ports.c
index 86124b8779..bcaf0aaeaa 100644
--- a/src/nspawn/nspawn-expose-ports.c
+++ b/src/nspawn/nspawn-expose-ports.c
@@ -58,17 +58,17 @@ int expose_port_parse(ExposePort **l, const char *s) {
                 memcpy(v, e, split - e);
                 v[split - e] = 0;
 
-                r = safe_atou16(v, &host_port);
-                if (r < 0 || host_port <= 0)
+                r = parse_ip_port(v, &host_port);
+                if (r < 0)
                         return -EINVAL;
 
-                r = safe_atou16(split + 1, &container_port);
+                r = parse_ip_port(split + 1, &container_port);
         } else {
-                r = safe_atou16(e, &container_port);
+                r = parse_ip_port(e, &container_port);
                 host_port = container_port;
         }
 
-        if (r < 0 || container_port <= 0)
+        if (r < 0)
                 return -EINVAL;
 
         LIST_FOREACH(ports, p, *l)
diff --git a/src/resolve/resolve-tool.c b/src/resolve/resolve-tool.c
index 9d4d04220c..07d9582ccb 100644
--- a/src/resolve/resolve-tool.c
+++ b/src/resolve/resolve-tool.c
@@ -881,8 +881,8 @@ static int resolve_tlsa(sd_bus *bus, const char *address) {
 
         port = strrchr(address, ':');
         if (port) {
-                r = safe_atou16(port + 1, &port_num);
-                if (r < 0 || port_num == 0)
+                r = parse_ip_port(port + 1, &port_num);
+                if (r < 0)
                         return log_error_errno(r, "Invalid port \"%s\".", port + 1);
 
                 address = strndupa(address, port - address);