diff --git a/docs/source/kibana.md b/docs/source/kibana.md
index 16b27b83..e6fa9702 100644
--- a/docs/source/kibana.md
+++ b/docs/source/kibana.md
@@ -86,7 +86,9 @@ table. Each row of the DKIM details table is one real DKIM signature, shown
 as a combined `selector / domain / result` value; the SPF details table
 shows `scope / domain / result` the same way. Combining the values into one
 column keeps each signature's selector, domain, and result paired together,
-rather than aggregating them as separate columns.
+rather than aggregating them as separate columns. Because a message that
+carries multiple DKIM signatures appears once per signature, summing the
+messages column across rows can exceed the total number of messages.
 
 :::{note}
 The alignment tables (SPF details, DKIM details) and the per-IP source