If it isn't a phishing attempt it would be really surprising to me that they would use http. BTW, https://exacttarget.com redirects to an official Salesforce product page, but that doesn't guarantee it to not be phishing.
Why? Technical incompetence is a systematic problem that comes from the top down. This is what happens when mediocrity becomes acceptable and takes priority over correctness.
I would suggest moving all of your business from Heroku ASAP. These kind of mistakes strongly suggest nobody capable of intelligent thought makes decisions at Heroku, nor has for awhile.
Spammers are the first to adopt https and all the mail and dns security stuff. It never was a sign of legitimacy