It isn’t the length. We accept a domain if its suffix is in the public suffix list, or if the top-level label is one of a small set reserved for private use: internal, lan, corp, intranet, private, home, local, localdomain, test, localhost. Your three-letter TLD is in neither, and when you drop a letter you land on a real country-code TLD, which is in the public suffix list. That’s the whole difference; two-letter TLDs are all ccTLDs.
For an isolated network, .internal is the one ICANN has formally reserved for exactly this, so something like mail.yourorg.internal will be accepted as-is. The same check runs on email addresses, which is why the ACME contact address was rejected as well.
If that namespace is fixed by infrastructure you can’t renumber, then making the list configurable is a reasonable thing to ask for and I’ll look at it. Separately, ACME won’t work on an air-gapped network whatever we do about domain validation, since no public CA is reachable. You want an internal CA or a manually installed certificate there.