The wisdom goes: "Make invalid states unrepresentable". In this case, foo.internal cannot represent a publicly accessible domain, much like 10.x.x.x cannot rep

The wisdom goes: "Make invalid states unrepresentable". In this case, foo.internal cannot represent a publicly accessible domain, much like 10.x.x.x cannot represent a publicly routable IP address. No matter how badly you misconfigure things, you are still protected from exposure. Sometimes it's really valuable.