diff --git a/ChangeLog.md b/ChangeLog.md
index 9e8ed3a..9d5ba48 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -15,6 +15,9 @@ repository history](https://github.com/ddclient/ddclient/commits/master).
   * The default web service for `--webv4` and `--webv6` has changed from Google
     Domains (which has shut down) to ipify.
     [5b104ad1](https://github.com/ddclient/ddclient/commit/5b104ad116c023c3760129cab6e141f04f72b406)
+  * Invalid command-line options or values are now fatal errors (instead of
+    discarded with a warning).
+    [#TODO](https://github.com/ddclient/ddclient/pull/TODO)
   * All log messages are now written to STDERR, not a mix of STDOUT and STDERR.
     [#676](https://github.com/ddclient/ddclient/pull/676)
   * For `--protocol=freedns` and `--protocol=nfsn`, the core module
diff --git a/ddclient.in b/ddclient.in
index 0ea9f08..31a30da 100755
--- a/ddclient.in
+++ b/ddclient.in
@@ -1953,19 +1953,12 @@ sub init_config {
     for my $k (keys %globals) {
         # TODO: This might grab an arbitrary protocol-specific variable, which could cause
         # surprising behavior.
-        my $def = $variables{'merged'}{$k};
-        if (!$def) {
-            warning("ignoring unknown setting '$k=$globals{$k}'");
-            delete($globals{$k});
-            next;
-        }
+        my $def = $variables{'merged'}{$k} or fatal("unknown option '$k=$globals{$k}'");
         # _read_config already checked any value from the config file, so the purpose of this check
         # is to validate command-line options which were merged into %globals above.
         # TODO: Move this check to where the command-line options are actually processed.
-        if (!eval { $globals{$k} = check_value($globals{$k}, $def); 1; }) {
-            warning("ignoring invalid variable value '$k=$globals{$k}': $@");
-            delete($globals{$k});
-        }
+        eval { $globals{$k} = check_value($globals{$k}, $def); 1; }
+            or fatal("invalid option value '$k=$globals{$k}': $@");
     }
 
     ## now the host definitions...
@@ -1978,9 +1971,7 @@ sub init_config {
         load_json_support($proto) if (grep($_ eq $proto, ("1984", "cloudflare", "digitalocean", "directnic", "gandi", "godaddy", "hetzner", "yandex", "nfsn", "njalla", "porkbun", "dnsexit2")));
 
         if (!exists($protocols{$proto})) {
-            warning("skipping host: %s: unrecognized protocol '%s'", $h, $proto);
-            delete $config{$h};
-            next;
+            fatal("host %s: unrecognized protocol: '%s'", $h, $proto);
         }
 
         my $svars = $protocols{$proto}{'variables'};
@@ -1994,15 +1985,8 @@ sub init_config {
             # check is to validate command-line options from --options which were merged into
             # $config{$h} above.
             # TODO: Move this check to where --options is actually processed.
-            if (!eval { $conf->{$k} = check_value($config{$h}{$k}, $def); 1; }) {
-                if ($def->{'required'}) {
-                    warning("skipping host $h: invalid variable value '$k=$config{$h}{$k}': $@");
-                    delete $config{$h};
-                    next HOST;
-                } else {
-                    warning("host $h: ignoring invalid variable value '$k=$config{$h}{$k}': $@");
-                }
-            }
+            eval { $conf->{$k} = check_value($config{$h}{$k}, $def); 1; }
+                or fatal("host $h: invalid option value '$k=$config{$h}{$k}': $@");
         }
         $config{$h} = $conf;
     }