If it says @yahoo.com in the 5322.From and you are using Gmail/Hotmail/AOL/Yahoo then it's going to be them:
DMARC Record for yahoo.com
_dmarc.yahoo.com. 1800 IN TXT "v=DMARC1\; p=reject\; sp=none\; pct=100\; rua=mailto:dmarc-yahoo-rua@yahoo-inc.com, mailto:dmarc_y_rua@yahoo.com\;"
I know it's them. Typing yahoo into a browser is almost as quick as reopening the email to click the link so I went for the safer option anyway. Reset password to something really easy to guess. I'm sure Snowden would approve.
If it says @yahoo.com in the 5322.From and you are using Gmail/Hotmail/AOL/Yahoo then it's going to be them:
DMARC Record for yahoo.com
_dmarc.yahoo.com. 1800 IN TXT "v=DMARC1\; p=reject\; sp=none\; pct=100\; rua=mailto:dmarc-yahoo-rua@yahoo-inc.com, mailto:dmarc_y_rua@yahoo.com\;"