If you're willing to assume glibc, a reasonably clean approach is to write your own nss_fly module that returns results for .internal. The downside is that Go

If you're willing to assume glibc, a reasonably clean approach is to write your own nss_fly module that returns results for .internal. The downside is that Go code will drop to cgo for all resolutions (because it will see something it can't handle in pure Go in resolv.conf) and non-glibc code (like Alpine containers using musl, or non-libc resolvers like ares) won't get anywhere at all. But you're kind of doomed in that latter case, anyway, because since there currently isn't a standard for how resolv.conf should express the rules you want, the effort to get it adopted by glibc, musl, Go, Chrome, ares, and all the other various interpreters of resolv.conf will take way too long to make a practical impact on a startup's product.