PEC vs Signed Email vs Registered Mail: What is Legally Valid

"Send it with proof of delivery" sounds simple until you start asking which proof, of what, with what legal weight. In Italy you have three common options: PEC (Posta Elettronica Certificata), cryptographically signed email (S/MIME or PGP), and the old-school registered post with return receipt (raccomandata A/R). They look interchangeable but they prove very different things and cost very different amounts.

This article unpacks what each one actually does, when each is the right tool, and the common confusions that lead to legally weak evidence in disputes. We are not lawyers; this is an engineering and operational guide.

The Three Tools

What PEC Actually Is

PEC is a parallel email system regulated by Italian law (D.P.R. 68/2005). Messages are exchanged between PEC providers (Aruba, Legalmail, Namirial, Poste Italiane, etc.) and accompanied by receipts (ricevuta di accettazione and ricevuta di consegna). The receipts have legal weight equivalent to a raccomandata A/R.

Crucially:

• PEC works ONLY between PEC mailboxes. You cannot PEC to a Gmail address and expect legal value.
• Both sender and recipient must have PEC accounts.
• The legal value attaches to the receipts, not to the message content.
• Cost is per-message (€0.10-0.30 typical for prepaid plans) or per-account-per-year (€5-50).

What PEC Does NOT Prove

PEC proves:

• The message was sent at time T.
• The message arrived at the recipient's PEC mailbox at time T+delta.

PEC does NOT prove:

• That the recipient read the message.
• That the recipient owns the PEC mailbox personally (only that the account holder does).
• The content of the message is true.
• The attached files were created at any specific time (use digital timestamping for that).

What S/MIME Does

S/MIME signs and optionally encrypts a regular email. The signature ties the message to the holder of the private key, which (via PKI) ties to a certified identity. Anyone with the recipient's public key can verify the signature.

S/MIME proves:

• The message came from the holder of the signing key.
• The content has not been altered since signing.

S/MIME does NOT prove:

• Delivery (you have no receipt).
• Time of sending (unless a trusted timestamp is added).

Cost: a personal S/MIME certificate from a trusted CA is €30-100/year. Or free from Actalis for Italian residents (with caveats).

What Raccomandata A/R Does

Old-school registered post with return receipt. Statutory legal weight; the proof is the green/yellow receipt card the post office returns.

Raccomandata A/R proves:

• Something was deposited at the post office.
• Something was delivered to the recipient address.
• The recipient or a household member signed for it.

It does NOT prove:

• The content of the envelope.
• The recipient read it.

Cost: €6-9 per item in Italy. Latency: 1-5 working days.

Common Confusions

"I can PEC a Gmail address"

You can send a message from your PEC mailbox to a regular email address. Most PEC providers will let you. But you lose the legal weight: the receipt only confirms the message left your PEC system, not that it arrived at a certified destination.

"S/MIME = PEC for non-Italians"

No. S/MIME proves identity and integrity. PEC proves delivery. They are complementary, not interchangeable.

"Encrypted email is legally valid"

Encryption is about confidentiality, not legal value. You can sign and encrypt with S/MIME, but encryption alone proves nothing.

"DKIM is like a signature"

DKIM proves the message left the claimed sending domain. It does not prove individual identity, and there is no widely recognised legal framework attaching weight to DKIM signatures in disputes.

eIDAS and EU Recognition

The eIDAS regulation defines "Registered Electronic Delivery Service" at EU level. PEC is the Italian implementation; similar services exist in other countries (D-mail in Germany, MailVerify in France). They are interoperable in principle, but in practice cross-border PEC-style delivery is limited.

The 2024 eIDAS 2.0 introduces the EU Digital Identity Wallet which may eventually unify these. We are not there yet.

When to Use Which

Use PEC when

• You are in Italy and the recipient has a PEC mailbox.
• You need statutory legal weight (contract termination, formal notices, court communications).
• You need speed (vs raccomandata) and provable delivery.

Use S/MIME when

• You need to prove identity and content integrity, not delivery.
• You communicate across borders.
• You work in industries that mandate signed email (defence, certain regulated sectors).

Use Raccomandata A/R when

• The recipient has no PEC.
• You need to deliver physical content.
• You want the traditional, universally-recognised paper trail.

Use Standard Email (with DKIM/DMARC) when

• You do not need legal evidence (the 99% case).
• You need throughput, modern APIs, observability.
• You are sending receipts, password resets, marketing.

Hybrid Patterns

Common patterns:

• Default: standard SMTP with strong authentication.
• For contracts/notices to Italian B2B: PEC.
• For sensitive internal corporate comms: S/MIME signed.
• For cross-border legal notices: combination of S/MIME signed + courier with receipt.

What This Means for Transactional Email Systems

Most transactional email systems (Target SMTP, SendGrid, Postmark) are NOT PEC providers. We send standard SMTP with strong authentication. If your application needs to send legally valid PEC, integrate a PEC provider's API separately (Aruba PEC, Namirial PEC API).

A pattern we see often: SaaS in Italy needs to send order confirmations (standard SMTP) and contract terminations (PEC). The two flows live in different code paths, with different observability, retry semantics and cost models. That is correct — they are different products with different legal weights.

The Cost-Benefit View

Per 1,000 messages:

• Standard SMTP: €0.50-€2.00
• PEC: €100-300
• S/MIME: €0 (after cert) + cert cost
• Raccomandata A/R: €6,000-9,000

You do not casually send PEC for a marketing campaign. You do not casually send Raccomandata for anything.

Closing

PEC, S/MIME and Raccomandata A/R solve different problems with different legal weights at very different costs. The most common mistake is using one when you needed another — sending a PEC to a Gmail address and expecting legal value, or sending an S/MIME signed message and expecting proof of delivery.

Target SMTP focuses on standard transactional and marketing email with strong authentication and policy-as-code (the Send-Time Firewall). We do not replace your PEC provider — but we make sure that the 99% of your email that does NOT need PEC flows reliably, observably and with the operational hygiene the legally-light traffic deserves.