[Gateway] Secure DNS location role (#20768)

* Add ZT role footnote

* Add DNS location column

* Rearrange columns

* Add DNS location footnote

* Add role criteria

* Add API caveat

* Add role to roles table

* Refine core docs

* Add additional role context

* Reword

* Add supersede roles

* Add supersede roles

Author: maxvp

src/content/docs/cloudflare-one/connections/connect-devices/agentless/dns/locations/index.mdx

@@ -45,6 +45,23 @@ For more information, refer to [DNS over TLS](/cloudflare-one/connections/connec
 
 Gateway requires a DoH endpoint for default DNS locations. For more information, refer to [DNS over HTTPS](/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https/).
 
+## Secure DNS locations
+
+Secure DNS locations provide additional protection against malicious domains for use in services such as [protective DNS (PDNS)](/reference-architecture/diagrams/sase/gateway-for-protective-dns/). For a DNS location to be considered secure, Gateway requires that:
+
+- Your IPv4 and IPv6 endpoints use your [BYOIP addresses](/cloudflare-one/connections/connect-devices/agentless/dns/locations/dns-resolver-ips/#bring-your-own-dns-resolver-ip) (if any).
+- [Source network filtering](/cloudflare-one/policies/gateway/network-policies/) is configured for your IPv4, IPv6, and DoT endpoints.
+- Source network filtering or token authentication are configured for your DoH endpoints.
+- Any enabled endpoints for a DNS location meet security permissions.
+
+You can assign users the [**Cloudflare Zero Trust DNS Locations Write** role](/cloudflare-one/roles-permissions/#zero-trust-roles) to grant them the permission to create and edit secure DNS locations. To allow users to view locations, you must also assign the **Cloudflare Zero Trust Read Only** role. Users with these roles can view any DNS location, but can only create or edit secure locations.
+
+Roles that supersede **Cloudflare Zero Trust DNS Locations Write** include:
+
+- Cloudflare Gateway
+- Cloudflare Zero Trust
+- Super Administrator
+
 ## Limitations
 
 ### Captive portals

src/content/docs/cloudflare-one/roles-permissions.mdx

@@ -13,19 +13,20 @@ To check the list of members in your account, or to manage roles and permissions
 
 Only Super Administrators will be able to assign or remove the following roles from users in their account. Scroll to the right to see a full list of permissions for each role.
 
-|                                 | Access Read | Access Edit | Gateway Read | Gateway Edit | Gateway Report | Billing Read | Billing Edit | DEX Read | DEX Edit |
-| ------------------------------- | ----------- | ----------- | ------------ | ------------ | -------------- | ------------ | ------------ | -------- | -------- |
-| Super Administrator             | ✅          | ✅          | ✅           | ✅           | ✅             | ✅           | ✅           | ✅       | ✅       |
-| Cloudflare Zero Trust           | ✅          | ✅          | ✅           | ✅           | ✅             | ✅           | ❌           | ✅       | ✅       |
-| Cloudflare Access               | ✅          | ✅          | ✅           | ❌           | ✅             | ✅           | ❌           | ❌       | ❌       |
-| Cloudflare Gateway              | ✅          | ❌          | ✅           | ✅           | ✅             | ✅           | ❌           | ❌       | ❌       |
-| Cloudflare Zero Trust Read Only | ✅          | ❌          | ✅           | ❌           | ✅             | ✅           | ❌           | ❌       | ❌       |
-| Cloudflare Zero Trust Reporting | ❌          | ❌          | ❌           | ❌           | ✅             | ✅           | ❌           | ✅       | ❌       |
-| Cloudflare DEX                  | ❌          | ❌          | ❌           | ❌           | ❌             | ❌           | ❌           | ✅       | ✅       |
-
-:::note
-The Cloudflare Zero Trust role grants administrator access to all Zero Trust products including Access, Gateway, WARP, Tunnel, Browser Isolation, CASB, DLP, DEX, and Email Security.
-:::
+|                                               | Access Read | Access Edit | Gateway Read | Gateway Edit | Gateway Report | DNS Location Read | DNS Location Edit | Billing Read | Billing Edit | DEX Read | DEX Edit |
+| --------------------------------------------- | ----------- | ----------- | ------------ | ------------ | -------------- | ----------------- | ----------------- | ------------ | ------------ | -------- | -------- |
+| Super Administrator                           | ✅          | ✅          | ✅           | ✅           | ✅             | ✅                | ✅                | ✅           | ✅           | ✅       | ✅       |
+| Cloudflare Zero Trust[^1]                     | ✅          | ✅          | ✅           | ✅           | ✅             | ✅                | ✅                | ✅           | ❌           | ✅       | ✅       |
+| Cloudflare Access                             | ✅          | ✅          | ✅           | ❌           | ✅             | ❌                | ❌                | ✅           | ❌           | ❌       | ❌       |
+| Cloudflare Gateway                            | ✅          | ❌          | ✅           | ✅           | ✅             | ✅                | ✅                | ✅           | ❌           | ❌       | ❌       |
+| Cloudflare Zero Trust Read Only               | ✅          | ❌          | ✅           | ❌           | ✅             | ✅                | ❌                | ✅           | ❌           | ❌       | ❌       |
+| Cloudflare Zero Trust Reporting               | ❌          | ❌          | ❌           | ❌           | ✅             | ❌                | ❌                | ✅           | ❌           | ✅       | ❌       |
+| Cloudflare Zero Trust DNS Locations Write[^2] | ❌          | ❌          | ❌           | ❌           | ❌             | ✅                | ✅                | ❌           | ❌           | ❌       | ❌       |
+| Cloudflare DEX                                | ❌          | ❌          | ❌           | ❌           | ❌             | ❌                | ❌                | ❌           | ❌           | ✅       | ✅       |
+
+[^1]: The **Cloudflare Zero Trust** role grants administrator access to all Zero Trust products including Access, Gateway, WARP, Tunnel, Browser Isolation, CASB, DLP, DEX, and Email Security.
+
+[^2]: Users with the **Cloudflare Zero Trust DNS Locations Write** role can view all DNS locations for an organization but can only create and edit [secure DNS locations](/cloudflare-one/connections/connect-devices/agentless/dns/locations/#secure-dns-locations).
 
 ### Cloudflare Zero Trust PII