RFC 6761 reserves the TLDs .example, .invalid, .localhost and .test. Additionally, RFC 6762 reserves the TLDs .local and .app. This is a very low-priority suggestion (which may cause some other problems), but I think that Casket should not try to obtain certificates for these six TLDs unless explicitly asked with the tls directive.

The following configuration should NOT contact LetsEncrypt to obtain a certificate, and instead only bind on port 80:

react.localhost {
  proxy / 127.0.0.1:3000
}

Alternatively, (and this would probably be a lot more work), Casket could generate a self-signed certificate on its own for these reserved TLDs. In this case, it should probably output something to direct the user to trust the generated certificates. Casket already supports the tls self_signed directive, so it would probably behave similarly.