mbsync to sync maildirs over imap for laptop/desktop machines; exchange activesync for mobile where I want push.
I set up DKIM and SPF and enforce TLS internally (and have real certs and TLS = "may" on the edge).
Over the next year, I'd like to figure out a way to require TLS on certain domains, and maybe set up some kind of WoT and maybe even a standard for how to do that.
I'd probably set up/run mail for people if they paid reasonable amounts. $50/yr/mailbox isn't really a reasonable amount. $500/yr/mailbox isn't, either (from the other direction). So maybe about $120-240/yr/mailbox + $100-250/domain.
http://www.google.com/enterprise/apps/business/pricing.html
$5 a month / $50 a year.
I would never use Google for my mail (I do have a gmail account for when necessary, but I hate using it). They're probably more technically competent than most shitty mail hosters, but from a privacy/security perspective, outsourcing your mail to a company which will happily turn it over seems like a bad choice.
The only way I'd outsource my mail is to someone who can operate the server but not see the contents; this is technically difficult but could be done (relatively straightforward if you're willing to pay enough for dedicated hardware; conceivable with a better VM system someday).
Ideally also with options in free countries like Hong Kong and Switzerland (which I don't currently have).
For a regulated US company who was fully at risk to the USG already, Google Mail might be an ok choice. You still end up with the potential for civil discovery, but a document retention policy (i.e. destruction policy) of 6mo or less would address that, and Google does that for hosted mail if you want.