I was wondering why I could not resolve cock.li from where I am right now; and thought this may be related, but it turns out the DNSSEC signatures have expired[1] so my resolver is rejecting the answers.
This is probably because I had set up DNSSEC on my nameservers, but my registrar doesn't yet support DNSSEC for .li. I plan on moving to another registrar once the domain is closer to expiry. I guess I'll try to do something sooner than that to remove the DNSSEC entries that my nameserver is returning.