Comment by justusthane

You don’t need to use two separate domain names for that. Best practice is to use the external domain internally, and use your internal DNS server to point the records to internal IP addresses. That way you can still get public certs issued to internal services.