You mean the "domains" that >99% of users can't even resolve, which can't be used to send or receive email, and which you can't have SSL certificates issued for? Don't be daft.

A self-signed SSL cert could work for it. There may also exist other solutions that we are not aware of.

99% of the target users will resolve it if they want access (by installing the necessary browser extension).

As for system emails, etc., they can come through any regular domain.