diff --git a/src/content/docs/reference/policies/SitePolicies.mdx b/src/content/docs/reference/policies/SitePolicies.mdx
index bb89e0e..8794df6 100644
--- a/src/content/docs/reference/policies/SitePolicies.mdx
+++ b/src/content/docs/reference/policies/SitePolicies.mdx
@@ -18,8 +18,13 @@ Each rule can contain:
 - `Exceptions`: a list of sites which when matched bypasses this set of rules.
 - `Policies`: an object defining the site policies.
 
-> [!NOTE]
-> A "site" refers to a registerable domain, so `*.example.com` is a valid site but `*.com` is not.
+A "site" refers to a registrable domain, such as `example.com`, or `*` for all sites.
+Each entry in `Match` and `Exceptions` covers the domain and all of its subdomains:
+
+- The `*.` prefix is optional, so `example.com` and `*.example.com` both match `example.com`, `www.example.com`, and every other subdomain.
+- An entry that is more specific than a site widens to the whole site, so `mail.example.com` also matches `www.example.com` and `example.com`.
+  Firefox logs a warning in the Browser Console when it does this.
+- Firefox uses the [Public Suffix List](https://publicsuffix.org/) to work out the registrable domain, so multi-part suffixes such as `.co.uk` are handled correctly.
 
 Currently the supported site policies are:
 
@@ -54,47 +59,48 @@ Currently the supported site policies are:
 
 <PolicyExample policy="SitePolicies" />
 
-A wildcard `*` can be used to refer to all sites.
-For example this setting would disable the JIT for only `*.example.com`:
-
-```json
-[
-  {
-    "Match": ["*.example.com"],
-    "Policies": {
-      "DisableJit": true
-    }
-  }
-]
-```
+### Disabling the JIT on a site and its subdomains
 
-While this setting would disable the JIT on every site except `*.example.org`:
+This configuration disables the JIT engine on `example.com`.
+The entry has no `*.` prefix, but it still covers subdomains such as `www.example.com` and `mail.example.com`.
+Writing `*.example.com` has the same effect:
 
 ```json
-[
-  {
-    "Exceptions": ["*.example.org"],
-    "Policies": {
-      "DisableJit": true
-    }
+{
+  "policies": {
+    "SitePolicies": [
+      {
+        "Match": ["example.com"],
+        "Policies": {
+          "DisableJit": true
+        }
+      }
+    ]
   }
-]
+}
 ```
 
-This setting loads `*.example.com` in a container whose data is cleared once its last tab closes:
+### Isolating a site in a temporary container
+
+This configuration loads `example.com` in a container named `company`, keeping its cookies and storage separate from other sites.
+Setting `ephemeral` to `true` clears the container's data once its last tab closes, and at shutdown:
 
 ```json
-[
-  {
-    "Match": ["*.example.com"],
-    "Policies": {
-      "Container": {
-        "id": "company",
-        "ephemeral": true
+{
+  "policies": {
+    "SitePolicies": [
+      {
+        "Match": ["example.com"],
+        "Policies": {
+          "Container": {
+            "id": "company",
+            "ephemeral": true
+          }
+        }
       }
-    }
+    ]
   }
-]
+}
 ```
 
 ## Windows (GPO)