diff --git a/tools/lib/test_script.py b/tools/lib/test_script.py
index 0420d7d36f..ebdd46cf78 100644
--- a/tools/lib/test_script.py
+++ b/tools/lib/test_script.py
@@ -1,7 +1,7 @@
 from __future__ import absolute_import
 from __future__ import print_function
 
-from typing import Tuple
+from typing import Optional, Tuple
 
 import os
 from distutils.version import LooseVersion
@@ -46,7 +46,7 @@ Do this: `./tools/provision`
 '''
 
 def get_provisioning_status():
-    # type: () -> Tuple[bool, str]
+    # type: () -> Tuple[bool, Optional[str]]
 
     version_file = get_version_file()
     if not os.path.exists(version_file):
diff --git a/zerver/lib/utils.py b/zerver/lib/utils.py
index 84b6cea768..430bfd4272 100644
--- a/zerver/lib/utils.py
+++ b/zerver/lib/utils.py
@@ -207,7 +207,7 @@ def is_subdomain_root_or_alias(request):
     return not subdomain or subdomain in settings.ROOT_SUBDOMAIN_ALIASES
 
 def check_subdomain(realm_subdomain, user_subdomain):
-    # type: (Text, Text) -> bool
+    # type: (Optional[Text], Optional[Text]) -> bool
     if settings.REALMS_HAVE_SUBDOMAINS and realm_subdomain is not None:
         if (realm_subdomain == "" and user_subdomain is None):
             return True
diff --git a/zproject/local_settings.py b/zproject/local_settings.py
index b5ce5e5efc..cf8cac3746 100644
--- a/zproject/local_settings.py
+++ b/zproject/local_settings.py
@@ -9,7 +9,7 @@
 import platform
 import six.moves.configparser
 from base64 import b64decode
-from typing import Set
+from typing import Optional, Set
 
 config_file = six.moves.configparser.RawConfigParser()  # type: ignore # https://github.com/python/typeshed/pull/206
 config_file.read("/etc/zulip/zulip.conf")
@@ -99,7 +99,7 @@ EMAIL_GATEWAY_EXTRA_PATTERN_HACK = r'@[\w-]*\.zulip\.net'
 EMAIL_GATEWAY_BOT = "emailgateway@zulip.com"
 
 
-SSO_APPEND_DOMAIN = None  # type: str
+SSO_APPEND_DOMAIN = None  # type: Optional[str]
 
 AUTHENTICATION_BACKENDS = ('zproject.backends.EmailAuthBackend',
                            'zproject.backends.GoogleMobileOauth2Backend')
diff --git a/zproject/prod_settings_template.py b/zproject/prod_settings_template.py
index 23ecb8ba6a..18d3997237 100644
--- a/zproject/prod_settings_template.py
+++ b/zproject/prod_settings_template.py
@@ -1,3 +1,5 @@
+from typing import Optional
+
 # Zulip Settings intended to be set by a system administrator.
 #
 # See http://zulip.readthedocs.io/en/latest/settings.html for
@@ -128,7 +130,7 @@ AUTHENTICATION_BACKENDS = (
 # set this to your domain (e.g. if REMOTE_USER is "username" and the
 # corresponding email address is "username@example.com", set
 # SSO_APPEND_DOMAIN = "example.com")
-SSO_APPEND_DOMAIN = None # type: str
+SSO_APPEND_DOMAIN = None # type: Optional[str]
 
 
 ### OPTIONAL SETTINGS
@@ -358,7 +360,7 @@ AUTH_LDAP_USER_SEARCH = LDAPSearch("ou=users,dc=example,dc=com",
 
 # If the value of a user's "uid" (or similar) property is not their email
 # address, specify the domain to append here.
-LDAP_APPEND_DOMAIN = None # type: str
+LDAP_APPEND_DOMAIN = None # type: Optional[str]
 
 # This map defines how to populate attributes of a Zulip user from LDAP.
 AUTH_LDAP_USER_ATTR_MAP = {