don't look up encryption config every record, RT#28526