diff --git a/doc/conf/examples/example.conf b/doc/conf/examples/example.conf
index 8ed0195fa..61511b08e 100644
--- a/doc/conf/examples/example.conf
+++ b/doc/conf/examples/example.conf
@@ -643,6 +643,23 @@ set {
 			global-throttle 30:60;
 		}
 
+		/* For IPv6 users, on top of 'maxperip' (which limits
+		 * connections per /64), connthrottle also limits how
+		 * many unknown users can be online from wider IPv6
+		 * prefixes (/56, /48, /32). This is an additional
+		 * security measure, separate from the rate-throttle
+		 * above. People in the security-group "known-users"
+		 * bypass this, as well as set::connthrottle::except.
+		 * The defaults below should fit most networks unchanged.
+		 * Uncomment to tune. Set a cidr-xx item to max 0;
+		 * to disable it.
+		 */
+		//ipv6-unknown-users-limit {
+		//	cidr-56 { max 8; }
+		//	cidr-48 { max 32; }
+		//	cidr-32 { max 256; }
+		//}
+
 		/* This configures when this module will NOT be active.
 		 * The default settings will disable the module when:
 		 * - The reputation module has been running for less than