Yes it is legit. We use it to protect stackoverflow.com
user cookies from third parties. The links in the email are all rewritten to a stackoverflow.email
subdomain, CNAMEd to a third party service we use for sending emails, and tracking email stats (spam reports, bounces, deliveries, views, clicks).
If we'd add a CNAME to a third party under the stackoverflow.com
domain, they'd receive all our users cookies, which some sites are OK with, but we aren't.
Another possible mitigation of this would be to set the secure flag on our user's cookies, and leave the third-party links as HTTP. We're not able to do that yet, since official HTTPS support is still 6-8 weeks from shipping. Ultimately, we want both links to be HTTPS, anyway.
TL;DR
You can verify this by visiting Stack Overflow via HTTPS, and looking at the certificate - it's the same one we use on stackoverflow.email.