.home.arpa is meant for this. It's supposed never resolve to any internet address so even if a DNS query ends up outside your network (like if an application handles DNS itself) it won't resolve to an internet address and send data there.

You can add .home.arpa to you DNS search path (configurable with DHCP) so you don't have to type it, e.g. if you look up "nas" your computer will try "nas.home.arpa" too.

One can also use one of the three .home .corp or .mail as of [0]. I'm not aware of an RFC that writes down that those are OK to use, but if the iCANN already pinky sweared that this is OK, what could go wrong?

[0] https://www.icann.org/resources/board-material/resolutions-2...

home.arpa

https://datatracker.ietf.org/doc/html/rfc8375

You can use anything that’s not already a domain (and unlikely to be one created by someone else).

josephcsibleinternaldomain.com as a spitball

.loc instead of .local government is fine

I've seen .test used in some guides

.internal