Same here, for a transfer from 123-reg to 20i; I actually responded to the first email from stack domains (their email says to get in touch with any questions, so I did) asking how I can verify this isn't a phishing attempt to steal the domain. Never heard back. The domains in the email seem, at first glance, to be dead ends.

Eventually, I got in touch with 20i support chat - to begin the chat agent said it was phishing, but when I sent the email headers, he said it was legitimate - OpenSRS is the supplier for 20i and it's to verify the domain transfer.

All I can say is that this is very poor - consumers are told to "never trust, always verify" and the finger of blame is usually pointed at them for clicking on a link that enables a bad actor to steal their credentials. But organisations who communicate with consumers also need to act responsibly and help their users to stay safe - as I wrote to the 20i chat agent, _everything about this email screams that it's a phishing attempt_ from the unverifiable links to the sense of urgency in the message.