Comment by phrygian

I use step-ca [0] for these sort of things and it works brilliantly. I barely see the point of having external DNS servers resolving your internal infrastructure.

[0] https://smallstep.com/certificates/