[est]

> The domain needs to be publicly resolvable

The company TLD was purposely built to hide behind the LAN. Been publicly resolvable is a huge a security risk. Public recursive resolvers will log where and when a user visits an internal site.

[hedora]

Why not have the public resolver resolve everything to a “Your DNS is misconfigured; contact IT” static page?

[gsich]

Not if you use an internal resolver.