docs: add operational best practices guide

docs/advanced/domain-filter.md

@@ -7,6 +7,12 @@ tags:
 
 # Domain Filter
 
+> **Important:** Domain filter flags express application-level intent — they are not an
+> enforcement boundary. Credentials (IAM policies, API token scopes, ACLs) are the real
+> enforcement boundary. A misconfigured or missing flag will expose all zones the credentials
+> can reach. Always scope API keys or IAM roles to only the specific zones external-dns manages;
+> use these flags to complement that boundary, not replace it.
+
 ExternalDNS has two modes for selecting which domains it manages: **plain domain filter** and **regex domain filter**.
 
 Using any of the regex filter flags enables the **regex domain filter** mode, which overrides and ignores the **plain domain filter** flags.

docs/advanced/events.md

@@ -112,32 +112,8 @@ sequenceDiagram
 
 ## Supported Sources
 
-Events are emitted for all sources that External-DNS supports. The following table lists the sources and whether they currently emit events.
-If a source does not emit events, it may in the future.
-
-| Source                 | Supported |
-|:-----------------------|:---------:|
-| `ambassador-host`      |           |
-| `connector`            |           |
-| `contour-httpproxy`    |           |
-| `crd`                  |           |
-| `empty`                |           |
-| `f5-transportserver`   |           |
-| `f5-virtualserver`     |           |
-| `fake`                 |     ✅    |
-| `gateway-grpcroute`    |           |
-| `gateway-httproute`    |           |
-| `gateway-tcproute`     |           |
-| `gateway-tlsroute`     |           |
-| `gateway-udproute`     |           |
-| `gloo-proxy`           |           |
-| `ingress`              |           |
-| `istio-gateway`        |           |
-| `istio-virtualservice` |           |
-| `kong-tcpingress`      |           |
-| `node`                 |           |
-| `openshift-route`      |           |
-| `pod`                  |           |
-| `service`              |           |
-| `skipper-routegroup`   |           |
-| `traefik-proxy`        |           |
+Events are emitted for all sources that External-DNS supports. Event support is being rolled out
+progressively — if a source does not yet emit events, it may in the future.
+
+See the [sources reference](../sources/index.md#available-sources) for the full list and
+per-source event support status.