Try to check the SPF and DKIM against Yahoo's to help determine whether the email is real or not. To answer your point though, it is unfortunately very common

Try to check the SPF and DKIM against Yahoo's to help determine whether the email is real or not. To answer your point though, it is unfortunately very common for organisations to use alternate domains for services you'd expect to have a high level of security. For example many banks have their online banking portal on a completely separate domain. The main website might be "examplebank.tld", while the online banking portal is "examplebank-portal.tld". Why they don't just use "portal.examplebank.tld" is a mystery...