My e-mail system is set to prefer TLS wherever possible. Spot-checks of headers incoming from other sources show that, at the minimum, a TLS session is successfully negotiated approximately 85% of the time so messages from those sources are presumed to be encrypted while in transit. All clients must connect using TLS (either IMAP-S or HTTPS). Yes, unencrypted copies likely exist on the sending side (the data storage disks for my e-mail servers are encrypted) and the client storage for some of my users is in the clear but it's not possible for my ISP to read the bits in flight.
If they want to get you they're gonna get you. The point is that takes a lot more work than the analyst sitting at his desk typing in friggin Google searches on your Gmail.
Given that I am not an US-citizen I would argue that I am better of an provider outside.. namely myself. Have fun puzzling together a complete picture from dozens of providers.
Right, but my email service is not likely to suddenly disappear overnight (like post) and also isn't owned and controlled by a large corporations in the same pocket as the US government (which isn't even my government... but seemingly still has access to my emails...).
Here is a great guide for anyone interested: https://www.exratione.com/2012/05/a-mailserver-on-ubuntu-120...
I set mine up on CentOS 5 using this guide. I would recommend you also look at DKIM signing and SPF records to improve deliverability! :)