Presumably, I just need to make my internal DNS server claim to be authoritative for those domains?

Yes. Make it authoritative for your local domains, and lookup and cache everything else. Then just point all your internal machines to it, whether through dhcp or statically, and you're all set. The internal computers won't be aware that public addresses are available as long as they're using the internal dns. When your laptop has an outside ip address using outside dns, it goes to (and through) the firewall, along with the rest of the public.

-jk