If an email provider uses an .onion address, does the email exit their servers into the internet through a tor exit node? Could a powerful adversary track it?
It depends, there are a few scenarios.
Internal mail, from:
- The email never leaves the foo.com server(s), there's no way to intercept it without compromising the mail server(s).
Onion to onion, from:
- This is the same as internal except now either of the two servers would need to be compromised to gain visibility. It would need to be supported by both mail providers to work, which isn't common, I don't know of any that do.
External to onion, from:
- This is mostly the same as onion to onion, since the outbound mail from foo.com connects over tor to bar.onion.
Onion to external, from:
- Yes, this would traverse the internet in some way and would have to leave the Tor network.
- Onion to onion mail isn't widely supported, until it is this is mostly irrelevant.
- Email is protected in-transit anyway, on any well configured mail service. The connection from foo.com to bar.com would be encrypted using TLS, taking it out of the reach of a passive man-in-the-middle adversary anyway.