An SMTP session between two mail servers may be encrypted, but only if both ends support it and if both ends choose to use it. So if you're sending mail from Gmail to example.net, then Google could only encrypt if example.net was ready and willing. For this reason, you cannot trust email to be even moderately secure at the transport layer. (The only safe end-to-end method is to encrypt your email using S/MIME or PGP, but the people you're exchanging email with need to be on board too... just like the mail servers).
As to whether the big three are performing opportunistic STARTTLS, I haven't seen any evidence of it, but I spend less time reading my mail server logs than I used to. And if they are, they're still only half of every SMTP connection they make, and cannot guarantee the use of encryption.
I just banner tested MX hosts for gmail.com, yahoo.com, and hotmail.com. Only gmail advertises STARTTLS, which is to say, only gmail would be willing to encrypt the SMTP session if the other party wanted to.
I tested gmail outbound by sending mail to a server I own and watching the wire; Google does indeed take advantage of STARTTLS if it is offered and encrypts the SMTP transaction when a gmail user is sending mail. Props to Google.
So as far as "sending" email encryption goes: Google 1, Yahoo 0, Microsoft 0.
As per the comments below, if you want to test these yourself, it's very simple:
- Determine the MX hosts (Mail eXchangers) for the domain
- Telnet to port 25 on one of them
- Type in "ehlo yourhostname.domain.com"
- If you don't see "250-STARTTLS" as one of the responses, they don't support opportunistic encryption.
$ host -t mx yahoo.com
yahoo.com mail is handled by 1 mta5.am0.yahoodns.net.
yahoo.com mail is handled by 1 mta7.am0.yahoodns.net.
yahoo.com mail is handled by 1 mta6.am0.yahoodns.net.
$ telnet mta5.am0.yahoodns.net 25
Connected to mta5.am0.yahoodns.net.
Escape character is '^]'.
220 mta1315.mail.bf1.yahoo.com ESMTP YSmtpProxy service ready
Connection closed by foreign host.
As a side note, Yahoo will close the connection if you don't ehlo right away. I had to cut & paste my ehlo because typing it in took too long.
As of January 2014, Yahoo is now encrypting - I just tested (as above) and verified. However, both The Register and Computerworld are reporting that the intracacies of SSL setup (such as Perfect Forward Secrecy) leave a lot to be desired as implemented by Yahoo.
EVEN MORER UPDATE:
Google is now including SMTP encryption data in their Transparency Report Safer Email section. They're sharing their data about who else is willing to encrypt, and you can look at the top numbers as well as query individual domains.