diff --git a/CHANGELOG.md b/CHANGELOG.md
index 21a13890..9e814060 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 
 ## Changed
 - OAuth: Rework access tokens to an `AES-256-GCM-SIV` AEAD format that carries the account name for proxy routing and revokes tokens on credential change.
+- Added more internal TLDs to the domain validation.
 
 ## Fixed
 - MTA: 
diff --git a/crates/utils/src/lib.rs b/crates/utils/src/lib.rs
index bac3fdbc..84484627 100644
--- a/crates/utils/src/lib.rs
+++ b/crates/utils/src/lib.rs
@@ -354,7 +354,18 @@ pub fn sanitize_domain(domain: &str) -> Option<String> {
 }
 
 pub fn is_valid_domain(domain: &str) -> bool {
-    const RESERVED_TLDS: &[&str] = &["test", "localhost", "local", "internal"];
+    const RESERVED_TLDS: &[&str] = &[
+        "test",
+        "localhost",
+        "local",
+        "internal",
+        "lan",
+        "home",
+        "corp",
+        "intranet",
+        "private",
+        "localdomain",
+    ];
     psl::domain(domain.as_bytes()).is_some_and(|d| d.suffix().typ().is_some())
         || RESERVED_TLDS.contains(&domain)
         || domain