My current setup for this:

I own a domain - say homelab.com - and use it exclusively in my internal network.

The public DNS records do only resolve to 127.0.0.1 (as my domain holster doesn’t want me to have no A record).

In my home network I have a pihole running that resolves this domain and it’s subdomains locally (say pihole.homelab.com, proxmox.homelab.com and so on).

For HTTPs: As this server is not publicly reachable, I use the DNS API of my domain host to get a let’s encrypt certificate with the DNS-01 challenge. That way, the internal systems do not need to be exposed to the internet.