Private/internal names

[martinthomson]

Should the specification require anything special of .local (RFC 6762), .home.arpa (RFC 8375), or .internal (ICANN internal) suffixes?

There are a few cases where internal services at companies are deployed with addresses from a public address space. These can be poorly protected as well, such that requiring CORS for the transition is potentially appropriate.