Ask HN: How do you handle private DNS for dev/staging environments?

We have multiple environments like (dev, staging, prod) and I'm tired of managing DNS for internal services. Current options all suck:

Public DNS entries → security risk

VPN + custom DNS → overkill, IT bottleneck, everyone complains

Editing /etc/hosts → obviously doesn't scale

I want devs to just access api.dev.company.internal without:

Asking IT to configure anything Running a full VPN Manual host file edits Exposing endpoints publicly

Am I missing an obvious solution? How do you handle this at your company?