diff --git a/Makefile.am b/Makefile.am
index 3e04fe06..e15feb96 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -567,6 +567,7 @@ TESTS = $(unit_tests)
 EXTRA_DIST = src/genbuiltin src/iwd.service.in src/net.connman.iwd.service \
 			wired/ead.service.in wired/net.connman.ead.service \
 			src/80-iwd.link src/pkcs8.conf unit/gencerts.cnf \
+			doc/main.conf \
 			$(manual_pages) $(patsubst %.1,%.rst, \
 					$(patsubst %.5,%.rst, \
 					$(patsubst %.8,%.rst,$(manual_pages))))
diff --git a/doc/main.conf b/doc/main.conf
new file mode 100644
index 00000000..e85aab10
--- /dev/null
+++ b/doc/main.conf
@@ -0,0 +1,44 @@
+# For complete description of supported configuration options, refer to
+# 'man 5 iwd.config'.
+
+[General]
+# iwd is capable of performing network configuration on its own, including
+# DHCPv4 based address configuration.  By default this behavior is
+# disabled, and an external service such as NetworkManager, systemd-network
+# or dhcpclient is required.  Uncomment the following line if you want iwd
+# to manage network interface configuration.
+#
+#EnableNetworkConfiguration=true
+#
+# iwd can randomize your WiFi card's MAC address for additional privacy.  By
+# default, this behavior is disabled and the MAC address assigned by the
+# kernel driver is used.  The address will be stable when connecting
+# to a saved network profile, so as to not interfere with any MAC filtering
+# rules that exist on the network.
+# If a randomized MAC address is desired, uncomment the setting line below:
+#
+#AddressRandomization=network
+#
+# Options below control the roaming thresholds on 2.4 & 5G bands.
+# Normally the default values are a good compromise that avoids excessive
+# scanning while maintaining good link quality.
+#
+#RoamThreshold=-70
+#RoamThreshold5G=-76
+#
+[Network]
+# If EnableNetworkConfiguration=true is set, iwd forwards DNS information to
+# the system resolving service.  The currently supported services are:
+# - systemd-resolved ["systemd"]
+# - openresolv / resolvconf ["resolvconf"]
+#
+# If not set, the value "systemd" is used by default.  Uncomment the value
+# below if you are using openresolv:
+#
+#NameResolvingService=resolvconf
+#
+# iwd's support for IPv6 is still experimental and is disabled by default.
+# If you want to try it anyway, uncomment the setting below.  Note that
+# configuration via SLAAC is currently not supported (DHCPv6 only).
+#
+#EnableIPv6=true