Update oauth.mdx

doc update for issue 14602

docs/http/oauth.mdx

@@ -296,7 +296,7 @@ upstream service and must not be modified.
 | **Client ID**             | -       | Your OAuth app's Client ID. Leave this empty if you want to use a managed application.                                                                                                                                                                                                                                                                     |
 | **Client Secret**         | -       | Your OAuth app's Client Secret. Leave this empty if you want to use a managed application.                                                                                                                                                                                                                                                                 |
 | **Allowed Emails**        | -       | If specified, only users whose emails match a value in this list will be allowed.                                                                                                                                                                                                                                                                          |
-| **Allowed Email Domains** | -       | If specified, only users whose emails match one of the given domains in this list will be allowed.                                                                                                                                                                                                                                                         |
+| **Allowed Email Domains** | -       | If specified, only users whose emails match one of the given domains in this list will be allowed. This is a perfect match, if using subdomains all must be listed.                                                                                                                                                                                        |
 | **Scopes**                |         | A list of additional scopes to request when users authenticate with the identity provider.                                                                                                                                                                                                                                                                 |
 | **Auth Check Interval**   | 0       | When a request is received after this interval has passed since the last auth check or the initial authentication, ngrok will re-validate its authorization constraints. As part of this process, ngrok refreshes data about the authenticated user from the identity provider. If zero, authorization is only ever checked during an authentication flow. |
 | **Inactivity Timeout**    | 0       | If an authenticated client does not make a request to the endpoint within this duration, they are forced to reauthenticate. If 0, no inactivity timeout is enforced.                                                                                                                                                                                       |