As former AD person and dealing with that several companies, the recommendation for internal network DNS has long been subdomain.company.com that is not on public internet.

Even today when setting up greenfield networks, I generally use internal.company.com. It also lets you get public trusted SSL certificates so you don't have to deal with internal PKI.

▲

Faelian2 6 hours ago | parent [-]

`.internal` and `.local` are safe and won't be used in the future. There are reserved for internal networks

	▲	john_strinlai 6 hours ago \| parent [-]
		while .local is reserved, it's reserved for mDNS, and should be avoided on things like active directory. using an internal subdomain of a registered public domain is best practice. .internal is also okay.