diff --git a/main.go b/main.go
index a9f1e4a..e0a33d1 100644
--- a/main.go
+++ b/main.go
@@ -27,7 +27,7 @@ func main() {
 	googleGroups := StringArray{}
 	redisSentinelConnectionURLs := StringArray{}
 
-	config := flagSet.String("config", "", "path to config file")
+	config := flagSet.String("config", "", "path to config file (Note when using config file, options are plural and s/-/_/: email-domain becomes email_domains and is a list)")
 	showVersion := flagSet.Bool("version", false, "print version string")
 
 	flagSet.String("http-address", "127.0.0.1:4180", "[http://]<addr>:<port> or unix://<path> to listen on for HTTP clients")
diff --git a/options.go b/options.go
index 706f6d5..6c44eff 100644
--- a/options.go
+++ b/options.go
@@ -222,7 +222,7 @@ func (o *Options) Validate() error {
 	}
 	if o.AuthenticatedEmailsFile == "" && len(o.EmailDomains) == 0 && o.HtpasswdFile == "" {
 		msgs = append(msgs, "missing setting for email validation: email-domain or authenticated-emails-file required."+
-			"\n      use email-domain=* to authorize all email addresses")
+			"\n      use email-domain=* to authorize all email addresses. If using config file, this should be email_domains=[\"*\"].")
 	}
 
 	if o.OIDCIssuerURL != "" {