You don't actually. You can just have them resolve in your local DNS server alone.
My current setup is that the public DNS records for my internal network just return CNAME records, so "mail.myserver.com" has a CNAME record to "mail.myserver.internal" and my private DNS server has an A record for "mail.myserver.internal".
Also useful for local development with mdns. E.g. MacBook-X.local as an CNAME: "MacBook-X.internal.hultner.se CNAME MacBook-X.local" should just work for LE on my local dev machine when roaming between the home, office or on the go and the actual IP changes wildly.
It's kind of nice to know that there is a mongo1.profiles.company.com somewhere.
Also, you should really consider all your subdomains to not be private information. It's risky to build security based around that assumption.
Tons of DNS services actually sell their queries, and those can be used to reconstruct these "private" subdomains.
And confirming what you said. DNS leaks everywhere, so don't consider its obscurity a form of security.
profiles.company.com? coffee.company.com.
mail.company.com? tomato.company.com.
passwords.company.com? tincan.company.com.
If you're really paranoid, you can just flood a bunch of misdirects in there as well. If you need 10 internal subdomains, add 100 subdomains with random CNAMEs.