OUTPUT chains are traversed for packets delivered to and sent from applications running on the local machine.
If an application sends out a packet, it traverses
app -> OUTPUT -> POSTROUTING -> interface
Conversely, a packet delivered to an application traverses
interface -> PREROUTING -> INPUT -> app
While a forwarded packet traverses
interface -> PREROUTING -> FORWARD -> POSTROUTING -> interface
MASQUERADE is just a special case of
SNAT, where the source address is taken from the interface.
Also see this picture or many similar ones you can find in
If you want to do
DNAT for packets sent from an application, you must use
DNAT only works in
PREROUTING, and outgoing packets from an application never traverse
POSTROUTING in case of applications sent to an applications, though I'm not sure about the current status of
INPUT, it may be broken and not actually work.
As most masquerading happens in a router forwarding packets, you don't see these kind of applications often.