190

I've just received an email from [email protected] titled Announcing the Stack Overflow Developer Story.

Is this a legit email? If so, how come you use this domain while other emails (e.g. job matches) come from [email protected]?

0

1 Answer 1

186

Yes it is legit. We use it to protect stackoverflow.com user cookies from third parties. The links in the email are all rewritten to a stackoverflow.email subdomain, CNAMEd to a third party service we use for sending emails, and tracking email stats (spam reports, bounces, deliveries, views, clicks).

If we'd add a CNAME to a third party under the stackoverflow.com domain, they'd receive all our users cookies, which some sites are OK with, but we aren't.

Another possible mitigation of this would be to set the secure flag on our user's cookies, and leave the third-party links as HTTP. We're not able to do that yet, since official HTTPS support is still 6-8 weeks from shipping. Ultimately, we want both links to be HTTPS, anyway.

TL;DR

You can verify this by visiting Stack Overflow via HTTPS, and looking at the certificate - it's the same one we use on stackoverflow.email.

10
  • 6
    surely the from address doesn't need to match the tracking domain?
    – undefined
    Commented Nov 24, 2016 at 21:22
  • @LukeMcGregor I guess it helps against spam filters though Commented Nov 25, 2016 at 15:41
  • 3
    exactly, the email's from address' domain gets checked via SPF / DKIM / DMARC, servers and clients can consider links to it verified
    – m0sa
    Commented Nov 25, 2016 at 15:45
  • 8
    Then this should be announced beforehand through official channels, because I thought it's phishing too. Especially when my mail client (Thunderbird) is putting big red warnings all over it that it is a possible scam :P All the links are obfuscated and looking at the source shows thtat the message bounced through several wanky third-party servers. I think that the only thing you forgot to put in there is some penile enlargement ads :q
    – SasQ
    Commented Jan 6, 2019 at 1:34
  • 1
    @SasQ what would you consider "beforehand" enough? We've been sending most emails through that domain for more than 2 years now. OTOH a big red warning in an email client is not desired behavior, so we'd really appreciate a separate question tagged bug or support, with the email details (at least the subject), your email provider / client details, exact warning message you see, chain of redirects for links that you consider malicious etc.
    – m0sa
    Commented Jan 6, 2019 at 13:39
  • 2
    By "beforehand" I meant sending a message from your official domain FIRST, informing the users that the new domain will be used and it is legitimate, so that they could add it to their whitelists instead of being surprised by fishy domains and dodgy-looking obfuscated URLs in messages coming from them. I haven't received any such notification, the messages just started coming from a different domain one day (October 13th, 2018, to be exact). First I just ignored them as phishing attempts, until they become too specific – then I started suspecting a data leak. Congratulations :q
    – SasQ
    Commented Jan 6, 2019 at 17:32
  • @Mosa stackoverflow.email is not a subdomain of stackoverflow.com. Commented Feb 12, 2019 at 16:47
  • @JonathanRosenne the emails are sent from a subdomain of stackoverflow.email. No mention of stackoverflow.com being a subdomain...
    – Dean Ward StaffMod
    Commented Feb 13, 2019 at 12:04
  • @DeanWard I think Jonathan's point was that if .email is a TLD, then stackoverflow.email and stackoverflow.com are two separate top level domain sites. But to clarify for others, it sounds like you're saying some subdomain of the TLD stackoverflow.email, e.g. research.stackoverflow.email, in order to fully protect the .com domain from 3rd parties.
    – TylerH
    Commented Oct 2, 2019 at 18:14
  • 2
    The SO site GUI needs to clearly say what sites a SO email might come from in the places where people can request interaction with SO that can result in an email from other than stackoverflow.com. It wasn't easy to find this post or any other info re whether the survey email i just got from stackoverflow.email is legitimate, including googling with 'site:meta.stackoverflow.com "stackoverflow.email" from stack overflow'.
    – philipxy
    Commented Dec 7, 2021 at 7:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .