Can you elaborate why one shouldn't use DNS validation for hosts you control in general?

That's not it. If you have an internal network, where every host is provisioned by you, you already control identity.

In that case there's no need to validate anything as names, dns records, certificates and anything else should already be in place.