Ah good point. I guess a future-proofed guarantee that the domain will never be used externally would be easier to use than trying to somehow configure my DNS to never update specific addresses.

Well as long as the TLD isn’t used by anyone it should work internally regardless of what ICANN says, especially if I add it to etc/hosts

Why do I care what ICANN says I can do on my own network? It’s my network, I do what I want.