diff --git a/config/action.d/nsupdate.conf b/config/action.d/nsupdate.conf
index 9ecb6f955..f845a44b3 100644
--- a/config/action.d/nsupdate.conf
+++ b/config/action.d/nsupdate.conf
@@ -20,6 +20,9 @@
 # keyfile	Full path to TSIG key file used for authentication between
 #		nsupdate and BIND.
 #
+# Create an nsupdate.local to set at least the <domain> and <keyfile>
+# options as they don't have default values.
+#
 # The ban and unban commands assume nsupdate will authenticate to the BIND
 # server using a TSIG key. The full path to the key file must be specified
 # in the <keyfile> parameter. Use this command to generate your TSIG key.