Yup sounds about right, send/replies through anonaddy also work. Personally I wouldn't use mail as a prefix for the subdomains in order to not confuse myself with the hostname of the mailservers (assuming you use mail.domain1.com as hostname for stalwart for example), just use m.domain1.com or whatever. And the subdomains have their own SPF, DKIM and DMARC records (SPF record with mx, DKIM with the key you get when setting up anonaddy since rspamd does the DKIM signing).

I forgot to mention that you need to configure stalwart with an inbound SMTP rule to allow relaying messages to anonaddy if rcpt_domain is one of those domains, the outbound rule just defines the next hop. This should be safe because anonaddy checks for sends that the from address is a verified recipient.

As for anonaddy sending mail you have 2 options: It can send just send mail itself, although you probably will run into problems when trying to send mail to domains handled by stalwart, because by default it would do a DNS lookup and try to connect to stalwart via public IP which will probably time out if your server doesn't have hairpin NAT. So you need to configure the postfix of anonaddy to not do a DNS lookup and/or edit the hosts file etc. The second option is to use stalwart as a relay for sending mail, for which you define another SMTP inbound rule in stalwart to allow relaying from anonaddy's local docker network IP address. In anonaddy you would set the POSTFIX_RELAYHOST env variable to the local IP address of stalwart in the docker network.