Email sent to customer from Drupal has RED LOCK icon in the email

Question

I'm using Drupal Commerce. Overall it's working well. I have SSL setup and enforced so users HAVE to use 'https' (via .htaccess). I'm able to test fill out the form and it submits. PayPal gets the payment. We're happy. I get an email telling me a new purchase has been made (via Drupal at site:mail token).

The issue is, the user also receives an email from Drupal letting them know, you know, thanks for purchasing, etc. However, in the email to the person who purchased the product (in gmail specifically as that's all I've tested with) there is a RED LOCK icon next to their name/email at the top of the email. When hovered over it says 'bluehost.com did not encrypt this message'.

Now, MAYBE it doesn't really matter because i'm not sending them their credit card info back to them or anything, but it does LOOK disconcerting and I'd like it not to be there in their email. So I need their email to be encrypted.

I talked to Bluehost and they said it was an internal linking issue. The only link in the form is their email address that they put in (it's a custom field we setup).

Does anyone know how to encrypt their email address in the form before Drupal sends it to them? Or tokenize it properly perhaps is another approach since site:mail doesn't have that issue.

Here's the token I'm using to send them the email from Drupal:

[commerce-order:commerce-customer-billing:field-email-address]

Note: I'm using 'Send mail with Variable' action to send this email, if that's worth noting.

Answer 1

I've read both your questions regarding this issue posted here. IMHO the red lock is not a thing you can overcome by encrypting the contents of your mail before sending it via an unencrypted channel.

This issue is not directly connected to Drupal, but to your Drupals mail gateway. Obviously your mail relay is not supporting TLS mail forwarding.

I do suppose you are sending the mails using Drupals built-in mail functions. These functions do use the PHP mailing functions, which by default are set-up to use your hosts mail services.

If you are working with a root server and installed your mail server yourself (e.g. postfix on Unix), you have to digg into its configuration and make sure it is set-up to use TLS when connecting to other mail servers.

When you don't have direct access to these settings (e.g. on a shared hosting package), you can overcome this issue by creating a mail account with a third-party email provider that is using TLS (e.g. gmail itself). With this mail account you will also get SMTP credentials to use for sending mails from your desktops mail client.

In your Drupal, you can install and configure the SMTP module to use these credentials for letting Drupal send mails via this external mail provider. Please note that some mail providers have flood mailing prevention in place that do allow a certain amount of mails each time/per minute only. So you might additionally consider using Queue Mail and a Cron job to send your mails in batches.

Edit: Drawback of the second solution is, that the mails received by your sites visitors may have been flagged as "x-forwarded" or have the third-parties mail provider email address as sender. Some mail clients therefore may mark the mails as spam.

So another solution for shared hosting: Ask your hosting provider to change the default mail server settings.