diff --git a/conf.c b/conf.c
index 4eb9e3d..7c4930a 100644
--- a/conf.c
+++ b/conf.c
@@ -1022,8 +1022,8 @@ void conf(struct ctx *c, int argc, char **argv)
 		{"mac-addr",	required_argument,	NULL,		'M' },
 		{"gateway",	required_argument,	NULL,		'g' },
 		{"interface",	required_argument,	NULL,		'i' },
-		{"dns",		optional_argument,	NULL,		'D' },
-		{"search",	optional_argument,	NULL,		'S' },
+		{"dns",		required_argument,	NULL,		'D' },
+		{"search",	required_argument,	NULL,		'S' },
 		{"no-tcp",	no_argument,		&c->no_tcp,	1 },
 		{"no-udp",	no_argument,		&c->no_udp,	1 },
 		{"no-icmp",	no_argument,		&c->no_icmp,	1 },
@@ -1077,16 +1077,6 @@ void conf(struct ctx *c, int argc, char **argv)
 
 		name = getopt_long(argc, argv, optstring, options, NULL);
 
-		if ((name == 'D' || name == 'S') && !optarg &&
-		    optind < argc && *argv[optind] && *argv[optind] != '-') {
-			if (c->mode == MODE_PASTA) {
-				if (conf_ns_opt(c, nsdir, userns, argv[optind]))
-					optarg = argv[optind++];
-			} else {
-				optarg = argv[optind++];
-			}
-		}
-
 		switch (name) {
 		case -1:
 		case 0:
@@ -1397,17 +1387,26 @@ void conf(struct ctx *c, int argc, char **argv)
 			}
 			break;
 		case 'D':
-			if (c->no_dns ||
-			    (!optarg && (dns4 - c->ip4.dns || dns6 - c->ip6.dns))) {
-				err("Empty and non-empty DNS options given");
-				usage(argv[0]);
-			}
+			if (!strcmp(optarg, "none")) {
+				if (c->no_dns) {
+					err("Redundant DNS options");
+					usage(argv[0]);
+				}
+
+				if (dns4 - c->ip4.dns || dns6 - c->ip6.dns) {
+					err("Conflicting DNS options");
+					usage(argv[0]);
+				}
 
-			if (!optarg) {
 				c->no_dns = 1;
 				break;
 			}
 
+			if (c->no_dns) {
+				err("Conflicting DNS options");
+				usage(argv[0]);
+			}
+
 			if (dns4 - &c->ip4.dns[0] < ARRAY_SIZE(c->ip4.dns) &&
 			    inet_pton(AF_INET, optarg, dns4)) {
 				dns4++;
@@ -1424,17 +1423,26 @@ void conf(struct ctx *c, int argc, char **argv)
 			usage(argv[0]);
 			break;
 		case 'S':
-			if (c->no_dns_search ||
-			    (!optarg && dnss != c->dns_search)) {
-				err("Empty and non-empty DNS search given");
-				usage(argv[0]);
-			}
+			if (!strcmp(optarg, "none")) {
+				if (c->no_dns_search) {
+					err("Redundant DNS search options");
+					usage(argv[0]);
+				}
+
+				if (dnss != c->dns_search) {
+					err("Conflicting DNS search options");
+					usage(argv[0]);
+				}
 
-			if (!optarg) {
 				c->no_dns_search = 1;
 				break;
 			}
 
+			if (c->no_dns_search) {
+				err("Conflicting DNS search options");
+				usage(argv[0]);
+			}
+
 			if (dnss - c->dns_search < ARRAY_SIZE(c->dns_search)) {
 				ret = snprintf(dnss->n, sizeof(*c->dns_search),
 					       "%s", optarg);
diff --git a/passt.1 b/passt.1
index 9bed946..14b01b2 100644
--- a/passt.1
+++ b/passt.1
@@ -171,7 +171,7 @@ version.
 Use \fIaddr\fR (IPv4 or IPv6) for DHCP, DHCPv6, NDP or DNS forwarding, as
 configured (see options \fB--no-dhcp-dns\fR, \fB--dhcp-dns\fR,
 \fB--dns-forward\fR) instead of reading addresses from \fI/etc/resolv.conf\fR.
-This option can be specified multiple times, and a single, empty option disables
+This option can be specified multiple times.  Specifying \fB-D none\fR disables
 usage of DNS addresses altogether.
 
 .TP
@@ -186,8 +186,9 @@ This option can be specified zero to two times (once for IPv4, once for IPv6).
 .BR \-S ", " \-\-search " " \fIlist
 Use space-separated \fIlist\fR for DHCP, DHCPv6, and NDP purposes, instead of
 reading entries from \fI/etc/resolv.conf\fR. See options \fB--no-dhcp-search\fR
-and \fB--dhcp-search\fR. A single, empty option disables the DNS domain search
-list altogether.
+and \fB--dhcp-search\fR. \fB--search none\fR disables the DNS domain search
+list altogether (if you need to search a domain called "none" you can use
+\fB--search none.\fR).
 
 .TP
 .BR \-\-no-dhcp-dns " " \fIaddr