Regular Expressions 101

Community Patterns

REGEX for parsing Received value in email headers (RFC822)

1

Regular Expression
ECMAScript (JavaScript)

/
(?:\sfrom\s+(?<from>[^\s*]+)[\s]*(?:(?:[\[\(.]?(?<fromh>.*?)?\.?\ *?[\[\(]?(?<fromip>(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+)?[\)\]]+)?)(?=[\s;]+(?:by|with|via|id|for|;)\s*?)|\s+by\s+(?<byv>.*?)(?:\s+?\((?:[a-z\-\.]*?\s+)*?\[?(?<byip>(?:(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+))*\]?\)?)?(?=[\s;]+(?:from|with|via|id|for|;)\s*?)|\s+via\s+(?<via>[a-z0-9\.\s]*?)(?=(?:\s*;|[\s]+(?:from|by|with|for|id|;))\s*?)|\swith\s+(?<protocol>(?:.|\s)*?)(?=(?:\s*;|[\s]+(?:from|by|via|for|id|;))\s*?)|\s+id\s+(?<id>[^\s;]+)(?=(?:\s*;|[\s]+(?:from|by|via|with|for|;))\s*?)|\s+for\s+<?(?<for>[^\s;>]+)>?(?=(?:\s*;|[\s]+(?:from|by|via|with|id|;))\s*?)|;\s+(?<date>[a-z]{3},\s+[0-9]{1,2}\s+[a-z]{3,4}\s+[0-9]{4}\s+[0-9]{2}\:[0-9]{2}\:[0-9]{2}\s+(?:-[0-9]{4}\s+)?(?:\([a-z]+\)|\+[0-9]{4}))?\n?)
/
gmi

Description

Example: Received: from VI1PR0102CA0029.eurprd01.prod.exchangelabs.com (2603:10a6:802::42) by VE1PR01MB5599.eurprd01.prod.exchangelabs.com (2603:10a6:803:11f::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2602.12; Thu, 9 Jan 2020 16:34:13 +0000

will give details for the emitter (from), receiver (by), for, date, ...

Submitted by anonymous - 7 months ago