diff --git a/cmd/cli.go b/cmd/cli.go
index 53b6994..3c06037 100644
--- a/cmd/cli.go
+++ b/cmd/cli.go
@@ -159,7 +159,7 @@ func parseFlags(args []string, version string) (*util.Options, []string, error)
 	)
 
 	// Don't sort the flags when -h is given
-	flagSet.SortFlags = false
+	flagSet.SortFlags = true
 
 	// Parse the flags
 	if err := flagSet.Parse(args[1:]); err != nil {
diff --git a/completions/fish.fish b/completions/fish.fish
index 5d74c37..1f1b68c 100644
--- a/completions/fish.fish
+++ b/completions/fish.fish
@@ -38,7 +38,7 @@ complete -f -c awl -s V -l version -d 'Print version and exit'
 
 # complete -f -c awl -a '+search +nosearch' -d 'Set whether to use searchlist'
 # complete -f -c awl -a '+showsearch +noshowsearch' -d 'Search with intermediate results'
-# complete -f -c awl -a '+recurse +norecurse' -d 'Recursive mode'
+complete -f -c awl -a '+recurse +norecurse' -d 'Recursive mode'
 complete -f -c awl -l no-truncate -a '+ignore +noignore' -d 'Dont revert to TCP for TC responses.'
 # complete -f -c awl -a '+fail +nofail' -d 'Dont try next server on SERVFAIL'
 # complete -f -c awl -a '+besteffort +nobesteffort' -d 'Try to parse even illegal messages'
@@ -59,8 +59,8 @@ complete -f -c awl -a '+all +noall' -d 'Set or clear all display flags'
 complete -f -c awl -a '+qr +noqr' -d 'Print question before sending'
 # complete -f -c awl -a '+nssearch +nonssearch' -d 'Search all authoritative nameservers'
 complete -f -c awl -a '+identify +noidentify' -d 'ID responders in short answers'
-# complete -f -c awl -a '+trace +notrace' -d 'Trace delegation down from root'
-complete -f -c awl -l dnssec -a '+dnssec +nodnssec' -d 'Request DNSSEC records'
+complete -f -c awl -a '+trace +notrace' -d 'Trace delegation down from root'
+complete -f -c awl -l dnssec -a '+dnssec +nodnssec +do +nodo' -d 'Request DNSSEC records'
 complete -f -c awl -a '+nsid +nonsid' -d 'Request Name Server ID'
 # complete -f -c awl -a '+multiline +nomultiline' -d 'Print records in an expanded format'
 # complete -f -c awl -a '+onesoa +noonesoa' -d 'AXFR prints only one soa record'
diff --git a/completions/zsh.zsh b/completions/zsh.zsh
index 269bd12..ac46304 100644
--- a/completions/zsh.zsh
+++ b/completions/zsh.zsh
@@ -28,7 +28,7 @@ local -a alts args
   '*+'{no,}'keepopen[keep TCP socket open between queries]'
   '*+'{no,}'recurse[set the RD (recursion desired) bit in the query]'
   # '*+'{no,}'nssearch[search all authoritative nameservers]'
-  # '*+'{no,}'trace[trace delegation down from root]'
+  '*+'{no,}'trace[trace delegation down from root]'
   # '*+'{no,}'cmd[print initial comment in output]'
   '*+'{no,}'short[print terse output]'
   '*+'{no,}'identify[print IP and port of responder]'
@@ -98,6 +98,7 @@ _arguments -s -C $args \
   '*-'{j,-json}'+[present the results as JSON]' \
   '*-'{X,-xml}'+[present the results as XML]' \
   '*-'{y,-yaml}'+[present the results as YAML]' \
+  '*--trace+[trace from the root]' \
   '*: :->args' && ret=0
 
 if [[ -n $state ]]; then
@@ -108,4 +109,4 @@ if [[ -n $state ]]; then
   fi
 fi
 
-return ret
\ No newline at end of file
+return ret
diff --git a/doc/awl.1.scd b/doc/awl.1.scd
index e43d93d..3035adf 100644
--- a/doc/awl.1.scd
+++ b/doc/awl.1.scd
@@ -114,6 +114,11 @@ Many options are inherited from *dig*(1).
 	Set the timeout period. Floating point numbers are accepted.
 	0.5 seconds is the minimum.
 
+*--trace*, *+trace*
+	Trace the path of the query from the root, acting like its own resolver.
+	This option enables DNSSEC.
+	When *@server* is specified, this will only affect the initial query.
+
 *--retries* _int_, *+tries*=_int_, *+retry*=_int_
 	Set the number of retries.
 	Retry is one more than tries, dig style.