diff --git a/ex/fksd/cmds/config.mkd b/ex/fksd/cmds/config.mkd
index fe81e9da..17dc819d 100644
--- a/ex/fksd/cmds/config.mkd
+++ b/ex/fksd/cmds/config.mkd
@@ -35,4 +35,8 @@ Zones are listed in the additional section of the reply packet
     USER. TXT   "DROPPOWER miekg list"
 
 
-The config is internally stored in some memory structure 
+The config is internally stored in some memory structure.
+
+
+    .FKS
+    ZONE.FKS.        USER.FKS.
diff --git a/server.go b/server.go
index ae0da4d5..718fb046 100644
--- a/server.go
+++ b/server.go
@@ -53,7 +53,7 @@ type response struct {
 // registered patterns add calls the handler for the pattern
 // that most closely matches the zone name. ServeMux is DNSSEC aware, meaning
 // that queries for the DS record are redirected to the parent zone (if that
-// is also registered).
+// is also registered), otherwise the child gets the query.
 type ServeMux struct {
 	m *radix.Radix
 }
@@ -350,6 +350,7 @@ func (c *conn) serve() {
 	}
 }
 
+// Write implements the ResponseWriter.Write method.
 func (w *response) Write(m *Msg) (err error) {
 	var (
 		data []byte
@@ -405,6 +406,7 @@ func (w *response) Write(m *Msg) (err error) {
 	return nil
 }
 
+// WriteBuf implements the ResponseWriter.WriteBuf method.
 func (w *response) WriteBuf(m []byte) (err error) {
 	// TODO(mg): refacter as we duplicate code from above?
 	if m == nil {
@@ -446,8 +448,8 @@ func (w *response) WriteBuf(m []byte) (err error) {
 	return nil
 }
 
-// RemoteAddr implements the ResponseWriter.RemoteAddr method
+// RemoteAddr implements the ResponseWriter.RemoteAddr method.
 func (w *response) RemoteAddr() net.Addr { return w.conn.remoteAddr }
 
-// TsigStatus implements the ResponseWriter.TsigStatus method
+// TsigStatus implements the ResponseWriter.TsigStatus method.
 func (w *response) TsigStatus() error { return w.tsigStatus }
diff --git a/tsig.go b/tsig.go
index c02c5e52..9f79272d 100644
--- a/tsig.go
+++ b/tsig.go
@@ -3,12 +3,12 @@
 // An TSIG or transaction signature adds a HMAC TSIG record to each message sent. 
 // The supported algorithm include: HmacMD5, HmacSHA1 and HmacSHA256.
 //
-// Basic use pattern when querying with a TSIG name "axfr." and the base64
-// secret "so6ZGir4GPAqINNh9U5c3A==":
+// Basic use pattern when querying with a TSIG name "axfr." (note that these key names
+// must be fully qualified) and the base64 secret "so6ZGir4GPAqINNh9U5c3A==":
 //
-//	m := new(dns.Msg)
 //	c := new(dns.Client)
 //	c.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
+//	m := new(dns.Msg)
 //	m.SetQuestion("miek.nl.", dns.TypeMX)
 //	m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
 //	...
@@ -32,9 +32,12 @@
 //
 // Basic use pattern validating and replying to a message that has TSIG set.
 //
-//	dns.ListenAndServeTsig(":8053", net, nil, map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="})
+//	server = new(dns.Server)
+//	server.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
+//	go server.ListenAndServe()
+//	dns.HandleFunc(".", handleRequest)
 //
-// 	func handleReflect(w dns.ResponseWriter, r *dns.Msg) {
+// 	func handleRequest(w dns.ResponseWriter, r *dns.Msg) {
 //		m := new(Msg)
 //		m.SetReply(r)
 //		if r.IsTsig() {
@@ -47,7 +50,6 @@
 //		}
 //		w.Write(m)
 //	}
-//
 package dns
 
 import (