diff --git a/keps/sig-network/20190125-ingress-api-group.md b/keps/sig-network/20190125-ingress-api-group.md
index e3ff2c20f42..46b34840850 100644
--- a/keps/sig-network/20190125-ingress-api-group.md
+++ b/keps/sig-network/20190125-ingress-api-group.md
@@ -244,7 +244,8 @@ The `IngressRule.Host` comment would be changed to:
 > If `Host` is a wildcard, then request matches the rule if the http host header
 > is to equal to the suffix (removing the first label) of the wildcard rule.
 > E.g. wildcard "*.foo.com" matches "bar.foo.com" because they share an equal
-> suffix "foo.com".
+> suffix "foo.com" but does NOT match "baz.bar.foo.com" because only the first
+> label is removed for a match.
 
 ### Healthchecks
 
@@ -539,4 +540,4 @@ KEP (roughly sorted by practicality):
 [re2-syntax]: https://github.com/google/re2/wiki/Syntax
 [s3-backend]: TODO
 [survey]: https://github.com/bowei/k8s-ingress-survey-2018
-[regex-survey]: https://en.wikipedia.org/wiki/Comparison_of_regular_expression_engines
\ No newline at end of file
+[regex-survey]: https://en.wikipedia.org/wiki/Comparison_of_regular_expression_engines