I've just received an email from [email protected]
titled Announcing the Stack Overflow Developer Story.
Is this a legit email? If so, how come you use this domain while other emails (e.g. job matches) come from [email protected]
?
I've just received an email from [email protected]
titled Announcing the Stack Overflow Developer Story.
Is this a legit email? If so, how come you use this domain while other emails (e.g. job matches) come from [email protected]
?
Yes it is legit. We use it to protect stackoverflow.com
user cookies from third parties. The links in the email are all rewritten to a stackoverflow.email
subdomain, CNAMEd to a third party service we use for sending emails, and tracking email stats (spam reports, bounces, deliveries, views, clicks).
If we'd add a CNAME to a third party under the stackoverflow.com
domain, they'd receive all our users cookies, which some sites are OK with, but we aren't.
Another possible mitigation of this would be to set the secure flag on our user's cookies, and leave the third-party links as HTTP. We're not able to do that yet, since official HTTPS support is still 6-8 weeks from shipping. Ultimately, we want both links to be HTTPS, anyway.
You can verify this by visiting Stack Overflow via HTTPS, and looking at the certificate - it's the same one we use on stackoverflow.email.
stackoverflow.email
. No mention of stackoverflow.com
being a subdomain...
Commented
Feb 13, 2019 at 12:04
stackoverflow.email
and stackoverflow.com
are two separate top level domain sites. But to clarify for others, it sounds like you're saying some subdomain of the TLD stackoverflow.email
, e.g. research.stackoverflow.email
, in order to fully protect the .com domain from 3rd parties.