This is probably because I had set up DNSSEC on my nameservers, but my registrar doesn't yet support DNSSEC for .li. I plan on moving to another registrar once the domain is closer to expiry. I guess I'll try to do something sooner than that to remove the DNSSEC entries that my nameserver is returning.