Treat domains like a trademark registration. You have x amount of time to show that you're actually using it for something. And that something has some kind of value.
There's issues with what's considered value, but our existing system is nonsense.
If it's 100% internal, you don't need to register them. If it's internet-facing but designed for use by registered users only, it'll still have some sort of authentication page, which should be enough proof that you're using it for something.
