On thing I've seen work well for corporate networks is use a different domain for infra than for public-facing servers.