diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
index bd77e23e0..25f82f7b4 100644
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -827,15 +827,24 @@ class HelpfulArgumentParser(object):
         parsed_args.verb = self.verb
 
         # Do any post-parsing homework here
+        if parsed_args.staging or parsed_args.dry_run:
+            if (parsed_args.server not in
+                    (flag_default("server"), constants.STAGING_URI)):
+                conflicts = ["--staging"] if parsed_args.staging else []
+                if parsed_args.dry_run:
+                    conflicts.append("--dry-run")
+                raise errors.Error("--server value conflicts with {0}".format(
+                    " and ".join(conflicts)))
 
-        # argparse seemingly isn't flexible enough to give us this behaviour easily...
-        if parsed_args.staging:
-            if parsed_args.server not in (flag_default("server"), constants.STAGING_URI):
-                raise errors.Error("--server value conflicts with --staging")
             parsed_args.server = constants.STAGING_URI
 
-        return parsed_args
+            if parsed_args.dry_run:
+                if self.verb != "certonly":
+                    raise errors.Error("--dry-run currently only works with the "
+                                       "'certonly' subcommand")
+                parsed_args.staging = True
 
+        return parsed_args
 
     def determine_verb(self):
         """Determines the verb/subcommand provided by the user.
diff --git a/letsencrypt/tests/cli_test.py b/letsencrypt/tests/cli_test.py
index e9bb8971d..24c5c5c82 100644
--- a/letsencrypt/tests/cli_test.py
+++ b/letsencrypt/tests/cli_test.py
@@ -394,11 +394,34 @@ class CLITest(unittest.TestCase):  # pylint: disable=too-many-public-methods
         parse = self._get_argument_parser()
         short_args = ['--staging']
         namespace = parse(short_args)
+        self.assertTrue(namespace.staging)
         self.assertEqual(namespace.server, constants.STAGING_URI)
 
         short_args += '--server example.com'.split()
         self._check_server_conflict_message(short_args, '--staging')
 
+    def _assert_dry_run_flag_worked(self, namespace):
+        self.assertTrue(namespace.dry_run)
+        self.assertTrue(namespace.staging)
+        self.assertEqual(namespace.server, constants.STAGING_URI)
+
+    def test_dry_run_flag(self):
+        parse = self._get_argument_parser()
+        short_args = ['--dry-run']
+        self.assertRaises(errors.Error, parse, short_args)
+
+        self._assert_dry_run_flag_worked(parse(short_args + ['auth']))
+        short_args += ['certonly']
+        self._assert_dry_run_flag_worked(parse(short_args))
+
+        short_args += '--server example.com'.split()
+        conflicts = ['--dry-run']
+        self._check_server_conflict_message(short_args, '--dry-run')
+
+        short_args += ['--staging']
+        conflicts += ['--staging']
+        self._check_server_conflict_message(short_args, conflicts)
+
     def test_parse_webroot(self):
         parse = self._get_argument_parser()
         webroot_args = ['--webroot', '-w', '/var/www/example',