Point your browser at a private resolver and the domain you are migrating answers with the new server's address, for you only. Real domain in the address bar, real certificate, working logins and checkout.
The usual approach proxies the site under a throwaway hostname. It shows you a page, and that is about all it can honestly do: the browser is on somebody else's domain, so the certificate cannot be validated for yours, cookies set for your domain do not stick, absolute URLs still load from the old server, and anything with a callback — OAuth, a payment return, a checkout step — fails.
Answering DNS instead removes every one of those problems at once. Your browser goes to the real domain, gets the real certificate, sets real cookies and follows real callbacks, because as far as it is concerned the migration has already happened. You are testing the thing you are about to ship, not an approximation of it.
It is also safer. No traffic passes through us, so there is nothing for us to log, cache or get wrong, and a preview cannot be used to make a phishing page: an override only takes effect on a device whose owner deliberately configured this resolver.