How is ZixCorp able to provide email encryption without a password?

Question

I am trying to understand how/if an email I received is being encrypted.

A financial institution sent me a verifiable email (i.e. not phising) asking me to fill out a pdf form to complete a transaction. The outbound email contained my account information and a completed pdf form in my reply would contain even more personal and banking information.

This email contained the words {secure message} in the subject and instructions to reply specifically to this email to ensure continued security. This message was sent to my gmail account and contained no PGP or S/MIME information. I have never set up any type of prior secure email configuration with this institution.

I replied to the sender expressing my concerns that this did not appear to be a secure means of communication. I was assured that the communication secure and used passwordless encryption provided by ZixCorp.

The company seems to offer 4 email security products:

• ZixGateway
• ZixAccess
• ZixPort
• ZixDirect

ZixPort pulls you to a secure portal to retrieve your message while ZixDirect prompts you for a password in your inbox, neither of which happened. The first two are only supposed to be for receivers with Zix email products. ZixGateway is just a public key-store the enforces rules compliance by chosing a best method of delivery including the above two options.

None of these seem to be describing the passwordless direct-to-inbox email my financial institutions claims is encrypted.

Does anyone know what could be going on? Is this type of encryption even possible?

---

Update 2014-08-05

Per makerofthings7's comment I checked the MX records for gmail.

$ nslookup -q=mx gmail.com
Server:     130.167.128.4
Address:    130.167.128.4#53

Non-authoritative answer:
gmail.com   mail exchanger = 20 alt2.gmail-smtp-in.l.google.com.
gmail.com   mail exchanger = 5 gmail-smtp-in.l.google.com.
gmail.com   mail exchanger = 30 alt3.gmail-smtp-in.l.google.com.
gmail.com   mail exchanger = 10 alt1.gmail-smtp-in.l.google.com.
gmail.com   mail exchanger = 40 alt4.gmail-smtp-in.l.google.com.

Authoritative answers can be found from:
gmail.com   nameserver = ns2.google.com.
gmail.com   nameserver = ns4.google.com.
gmail.com   nameserver = ns3.google.com.
gmail.com   nameserver = ns1.google.com.
ns2.google.com  internet address = 216.239.34.10
ns1.google.com  internet address = 216.239.32.10
ns3.google.com  internet address = 216.239.36.10
ns4.google.com  internet address = 216.239.38.10

There is no listing for zixvpm. Any ideas why this might be?

Answer 1

Two minutes of your time on Google (no fancy search terms, just "zix gmail") would have told you that Google have been doing some work with Zix to bring some features to their Gmail product... thus you can assume they have Zix integrated. ;-)

Reading the product description on the Zix website, you can inferr that both sender and receivers need Zix servers if the messages are to be seamlessly encrypted/decrypted... otherwise the recipient will need to take further steps.

It seems you just happened to be lucky you were using an email provider that has Zix integrated so that you could see the seamless decryption as Zix intended !

Answer 2

All of your confusion is because of the ZixDirectory. There is no public MX record for this mail server listing, although it was a good guess to look there. Zix uses a proprietary Zixvpm listing of all clients that can communicate directly. The {Secure Message} thingy is customizable by the sender. In recent years, Zix have used a blue bar which spans the message to indicate a secure message. See more about how Zix to Zix works here: http://www.zixcorp.com/email-encryption/zixdirectory/