--- a/mailnews/db/gloda/modules/mimemsg.js
+++ b/mailnews/db/gloda/modules/mimemsg.js
@@ -183,19 +183,29 @@ function MsgHdrToMimeMessage(aMsgHdr, aC
 
   let msgURI = aMsgHdr.folder.getUriForMsg(aMsgHdr);
   let msgService = gMessenger.messageServiceFromURI(msgURI);
 
   MsgHdrToMimeMessage.OPTION_TUNNEL = aOptions;
   let partsOnDemandStr = (aOptions && aOptions.partsOnDemand)
     ? "&fetchCompleteMessage=false"
     : "";
+  // By default, Enigmail only decrypts a message streamed via libmime if it's
+  // the one currently on display in the message reader. With this option, we're
+  // letting Enigmail know that it should decrypt the message since the client
+  // explicitly asked for it.
+  let encryptedStr = (aOptions && aOptions.examineEncryptedParts)
+    ? "&examineEncryptedParts=true"
+    : "";
 
-  // So unless the user explictly required that he wants to examine encrypted
-  // parts, give him a stripped-down version of the MimeMsg structure.
+  // S/MIME, our other encryption backend, is not that smart, and always
+  // decrypts data. In order to protect sensitive data (e.g. not index it in
+  // Gloda), unless the client asked for encrypted data, we pass to the client
+  // callback a stripped-down version of the MIME structure where encrypted
+  // parts have been removed.
   let wrapCallback = function (aCallback, aCallbackThis) {
     if (aOptions && aOptions.examineEncryptedParts)
       return aCallback;
     else
       return (function (aMsgHdr, aMimeMsg)
         aCallback.call(aCallbackThis, aMsgHdr, stripEncryptedParts(aMimeMsg))
       );
   };
@@ -222,17 +232,17 @@ function MsgHdrToMimeMessage(aMsgHdr, aC
   try {
     let streamURI = msgService.streamMessage(
       msgURI,
       streamListener, // consumer
       null, // nsIMsgWindow
       dumbUrlListener, // nsIUrlListener
       true, // have them create the converter
       // additional uri payload, note that "header=" is prepended automatically
-      "filter&emitter=js"+partsOnDemandStr,
+      "filter&emitter=js"+partsOnDemandStr+encryptedStr,
       requireOffline);
   } catch (ex) {
     // If streamMessage throws an exception, we should make sure to clear the
     // activeStreamListener, or any subsequent attempt at sreaming this URI
     // will silently fail
     if (activeStreamListeners[msgURI]) {
       delete activeStreamListeners[msgURI];
     }