Honestly, just spend the five bucks a year and reserve a real domain name with auto renew. You don't need to make it publicly resolvable, but you'll be 100% sure all of your internal service names won't ever conflict with anything used in the real world. If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt, so you can protect your internal services with HTTPS!
You don't suddenly want to be restricted to HTTPS only (i.e. when Google bought .dev). There's also the minor risk of someone eventually buying your domain and causing all kinds of funky hell, like setting proxies to your internal network (through WPAD) and the names of local services (printer, router, etc.) being queried to a real DNS server because your computer sometimes appends the domain name to TLD-less queries. I've seen it happen that someone set something like example.com as their local domain (including in the DHCP config) who then saw constant slowdowns as their browser tried to resolve http://local-service/ as http://local-service.example.com/, going out to the internet every time, and not caching the error response.
You don't suddenly want to be restricted to HTTPS only (i.e. when Google bought .dev). There's also the minor risk of someone eventually buying your domain and causing all kinds of funky hell, like setting proxies to your internal network (through WPAD) and the names of local services (printer, router, etc.) being queried to a real DNS server because your computer sometimes appends the domain name to TLD-less queries. I've seen it happen that someone set something like example.com as their local domain (including in the DHCP config) who then saw constant slowdowns as their browser tried to resolve http://local-service/ as http://local-service.example.com/, going out to the internet every time, and not caching the error response.