diff --git a/envoy/api/v2/listener/listener.proto b/envoy/api/v2/listener/listener.proto
index 5870ee6d..6889b467 100644
--- a/envoy/api/v2/listener/listener.proto
+++ b/envoy/api/v2/listener/listener.proto
@@ -48,8 +48,11 @@ message Filter {
 // Specifies the match criteria for selecting a specific filter chain for a
 // listener.
 message FilterChainMatch {
-  // If non-empty, the SNI domains to consider. May contain a wildcard prefix,
-  // e.g. ``*.example.com``.
+  // If non-empty, the SNI domain names to consider. May contain a wildcard prefix for
+  // the bottom-level domain of a domain name, e.g. ``*.example.com``. Note that
+  // ``foo.example.com`` will be matched by ``foo.example.com`` and ``*.example.com``
+  // SNI domain names, but **not** by ``*foo.example.com``, ``*oo.example.com``,
+  // ``*example.com``, ``*.com`` or ``*``.
   //
   // .. attention::
   //