diff --git a/docs/faq.rst b/docs/faq.rst
index 1d22d430..04373d3e 100644
--- a/docs/faq.rst
+++ b/docs/faq.rst
@@ -667,7 +667,7 @@ Please note that the provided example will block the subnet from sending any ema
 
   # Fail2Ban configuration file
   [Definition]
-  failregex = : Authentication attempt from <HOST> has been rate-limited\.$
+  failregex = : Authentication attempt from <HOST>(?: for (?:[^ ]+@[^ ]+))? has been rate-limited\.$
   ignoreregex =
   journalmatch = CONTAINER_TAG=mailu-admin