There is no way to tell from the address whether this is legitimate or a phishing spoof. Which is it?
Because of the quantity and quality of hacking scams, if this is legit, OCULUS should absolutely send it directly from the oculus address, and verify that it is being sent with a post on the Oculus developer page. plus Oculus' own twitter and facebook page.
Oculus should be at war with hackers, not sending (if it did) a survey that could have easily been a fake.