>One of the problems of that is now you need to list all your internal IP addresses in a public DNS server.

You don't actually. You can just have them resolve in your local DNS server alone.

My current setup is that the public DNS records for my internal network just return CNAME records, so "mail.myserver.com" has a CNAME record to "mail.myserver.internal" and my private DNS server has an A record for "mail.myserver.internal".

You don’t need to if you use ACME DNS challenge. I have split horizon where the ACME creates the temporary challenge record, LetsEncrypt sees it, and then the record is removed. There is never a public A record, and the window for enumerating the challenge record is short.

That said, I never really understood worrying about exposing DNS records because someone has to brute-force enumerate the domain names, and because it just obfuscates. I do split horizon for different reasons and am currently moving away from it.

Regardless, if you do care, you should be concerned about certificate transparency logs. The “workaround” for that is wildcard certs.