I'm using Drupal Commerce. Overall it's working well. I have SSL setup and enforced so users HAVE to use 'https' (via .htaccess). I'm able to test fill out the form and it submits. PayPal gets the payment. We're happy. I get an email telling me a new purchase has been made (via Drupal at site:mail token).

The issue is, the user also receives an email from Drupal letting them know, you know, thanks for purchasing, etc. However, in the email to the person who purchased the product (in gmail specifically as that's all I've tested with) there is a RED LOCK icon next to their name/email at the top of the email. When hovered over it says 'bluehost.com did not encrypt this message'.

Now, MAYBE it doesn't really matter because i'm not sending them their credit card info back to them or anything, but it does LOOK disconcerting and I'd like it not to be there in their email. So I need their email to be encrypted.

I talked to Bluehost and they said it was an internal linking issue. The only link in the form is their email address that they put in (it's a custom field we setup).

Does anyone know how to encrypt their email address in the form before Drupal sends it to them? Or tokenize it properly perhaps is another approach since site:mail doesn't have that issue.

Here's the token I'm using to send them the email from Drupal:


Note: I'm using 'Send mail with Variable' action to send this email, if that's worth noting.

  • It seems like maybe your host, bluehost.com, is not using TLS for outbound emails. And thus Google, which prefers TLS, is flagging the email as being insecurely transmitted over SMTP without TLS. I'm honestly not really sure what "internal linking" issue means. :/ Feb 12, 2016 at 5:40
  • You can try using Encrypt Form API to encrypt form element, if that helps encrypt email before sending.
    – Yogesh
    Feb 12, 2016 at 6:30
  • Thanks for the valuable suggestion my friends. I am going to follow-up on both and report back.
    – Sage
    Feb 12, 2016 at 8:42

1 Answer 1


I've read both your questions regarding this issue posted here. IMHO the red lock is not a thing you can overcome by encrypting the contents of your mail before sending it via an unencrypted channel.

This issue is not directly connected to Drupal, but to your Drupals mail gateway. Obviously your mail relay is not supporting TLS mail forwarding.

I do suppose you are sending the mails using Drupals built-in mail functions. These functions do use the PHP mailing functions, which by default are set-up to use your hosts mail services.

If you are working with a root server and installed your mail server yourself (e.g. postfix on Unix), you have to digg into its configuration and make sure it is set-up to use TLS when connecting to other mail servers.

When you don't have direct access to these settings (e.g. on a shared hosting package), you can overcome this issue by creating a mail account with a third-party email provider that is using TLS (e.g. gmail itself). With this mail account you will also get SMTP credentials to use for sending mails from your desktops mail client.

In your Drupal, you can install and configure the SMTP module to use these credentials for letting Drupal send mails via this external mail provider. Please note that some mail providers have flood mailing prevention in place that do allow a certain amount of mails each time/per minute only. So you might additionally consider using Queue Mail and a Cron job to send your mails in batches.

Edit: Drawback of the second solution is, that the mails received by your sites visitors may have been flagged as "x-forwarded" or have the third-parties mail provider email address as sender. Some mail clients therefore may mark the mails as spam.

So another solution for shared hosting: Ask your hosting provider to change the default mail server settings.

  • Yes, thank you for your correct responses. I contacted Bluehost again. Their mail server is not setup to account for this new gmail change and they say they are working on a fix for it. So you're right, there's nothing I can do but wait for them (or change hosts).
    – Sage
    Feb 17, 2016 at 23:13
  • @Sage, I am having the same issue with bluehost, just wondering, what did you end up doing?
    – No Sssweat
    Aug 23, 2016 at 8:50
  • Hey, they still haven't fixed it? They must have been lying about fixing it, or maybe they just don't know what they're talking about...neither inspires confidence. We just stopped sending important email through bluehost because we didn't want to freak out our customers when they purchased something on our website. Very sad to hear they haven't fixed it still :(
    – Sage
    Aug 23, 2016 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.