More recent leaks and evidence suggests that the email providers themselves are, as a rule, not cooperating with the NSA. Rather the telecom companies such as AT&T are. The NSA wholesale captures and analyzes all the traffic upstream of companies like Google and Yahoo, and through that get implicit access to anything that isn't encrypted. So the critical detail is this: Which companies encrypt their traffic?
I did some tests, and here's what I came up with:
Email Encryption Availability
On by default: ++
Off by default: +
Not available: -
Outbound Only: +*
Gmail Microsoft Yahoo AOL
Web Interface +++ +++ + -
POP3/IMAP +++ +++ ++ ++
SMTP ++ - +* +*
So Gmail does encryption everywhere it's possible, and won't even let you connect unencrypted if you're fetching your email.
Microsoft (Live/Hotmail/Outlook.com, etc.) Forces you to encrypt to retrieve your mail, but does not support
STARTTLS on port 25, neither inbound or outbound, so all mail to and from them is unencrypted.
Yahoo supports SSL across the board, but it's off by default on the web interface.
AOL doesn't even support SSL on their web interface, but does support it on the backend.
There's no "default" on/off state for SSL on POP3/IMAP, so I gave everyone the benefit of the doubt there.
Possibly most interesting: GMail will encrypt everything if you allow it, including server-to-server. Microsoft will not encrypt server-to-server, while Yahoo and AOL both do something odd: Both will encrypt server-to-server outbound email, but do not support STARTTLS on inbound email. So mail going from Yahoo or AOL will be encrypted if the destination supports it (e.g. Gmail), but mail going to Yahoo or AOL cannot be encrypted.
But with respect to server-to-server encryption, there's a catch: unencrypted connections are always supported, which makes a man-in-the-middle attack trivial. Simply MITM the connection on PORT 25, and filter out the line where the destination server advertises STARTTLS availability. Also, since certificate validity is rarely checked by mail servers, you can MITM the TLS session as well with a self-signed certificate.
Remember that email is inherently insecure in its very design. Using your ISP's email service or setting up your own may not be any better. Remember that its the network backbones that are getting tapped, not the mail service providers. So we're all similarly vulnerable. Use S/MIME or PGP/GPG if you need email security.