diff --git a/roles/dns-extern/files/updatepolicy.aliases b/roles/dns-extern/files/updatepolicy.aliases
index 871836d..604f626 100644
--- a/roles/dns-extern/files/updatepolicy.aliases
+++ b/roles/dns-extern/files/updatepolicy.aliases
@@ -2,7 +2,9 @@
 -- Define additional domains to allow (acme) updates for with an exisiting TSIG key
 --
 -- Line format:
---   alias["<domain-from-TSIG-key>"] = { "<san-domain1>", ... }
+--   alias["<domain-from-TSIG-key>"] = {}
+--   alias["<domain-from-TSIG-key>"]["<san-domain1>"] = "<san-domain1>"
+--   alias["<domain-from-TSIG-key>"]["<san-domain2>"] = "<san-domain2>"
 --
 -- WARNING: Trailing "." are important for correct validation on all used names
 --