regex101: REGEX for parsing Received value in email headers (RFC822)

Non-Capturing Group(?:\sfrom\s+(?<from>[^\s*]+)[\s]*(?:(?:[\[$.]?(?<fromh>.*?)?\.?\ *?[\[\(]?(?<fromip>(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+)?[$\]]+)?)(?=[\s;]+(?:by|with|via|id|for|;)\s*?)|\s+by\s+(?<byv>.*?)(?:\s+?$(?:[a-z\-\.]*?\s+)*?\[?(?<byip>(?:(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+))*\]?$?)?(?=[\s;]+(?:from|with|via|id|for|;)\s*?)|\s+via\s+(?<via>[a-z0-9\.\s]*?)(?=(?:\s*;|[\s]+(?:from|by|with|for|id|;))\s*?)|\swith\s+(?<protocol>(?:.|\s)*?)(?=(?:\s*;|[\s]+(?:from|by|via|for|id|;))\s*?)|\s+id\s+(?<id>[^\s;]+)(?=(?:\s*;|[\s]+(?:from|by|via|with|for|;))\s*?)|\s+for\s+<?(?<for>[^\s;>]+)>?(?=(?:\s*;|[\s]+(?:from|by|via|with|id|;))\s*?)|;\s+(?<date>[a-z]{3},\s+[0-9]{1,2}\s+[a-z]{3,4}\s+[0-9]{4}\s+[0-9]{2}\:[0-9]{2}\:[0-9]{2}\s+(?:-[0-9]{4}\s+)?(?:$[a-z]+$|\+[0-9]{4}))?\n?)

1st Alternative\sfrom\s+(?<from>[^\s*]+)[\s]*(?:(?:[\[$.]?(?<fromh>.*?)?\.?\ *?[\[\(]?(?<fromip>(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+)?[$\]]+)?)(?=[\s;]+(?:by|with|via|id|for|;)\s*?)

\sany whitespace character

fromthe literal text from (case insensitive)

\s+any whitespace character, repeated at least once

Group from(?<from>[^\s*]+)

Negated Character Class[^\s*]+

+matches at least one character outside the set below:

\sany whitespace character

*the literal * (42₁₀ / 52₈ / 2A₁₆)

Character Class[\s]*

*matches any number of characters from the set below:

\sany whitespace character

Non-Capturing Group(?:(?:[\[$.]?(?<fromh>.*?)?\.?\ *?[\[\(]?(?<fromip>(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+)?[$\]]+)?)

Non-Capturing Group(?:[\[$.]?(?<fromh>.*?)?\.?\ *?[\[\(]?(?<fromip>(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+)?[$\]]+)?

?repeats the group contents below at most once:

Character Class[\[\(.]?

?matches at most one character from the set below:

\[the literal [ (91₁₀ / 133₈ / 5B₁₆)

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

.the literal . (46₁₀ / 56₈ / 2E₁₆)

Group fromh(?<fromh>.*?)?

?repeats the group contents below at most once:

.*?any character (except for line terminators), repeated any number of times

\.?optionally matches the literal . (46₁₀ / 56₈ / 2E₁₆)

\ *?the literal (32₁₀ / 40₈ / 20₁₆) , repeated any number of times

Character Class[\[\(]?

?matches at most one character from the set below:

\[the literal [ (91₁₀ / 133₈ / 5B₁₆)

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

Group fromip(?<fromip>(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+)?

?repeats the group contents below at most once:

Non-Capturing Group(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+

+repeats the group contents below at least once:

Character Class[0-9a-z]*?

*?matches any number of characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

a-zone character from a (97₁₀) to z (122₁₀) (case insensitive)

Character Class[\.\:]+

+matches at least one character from the set below:

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\:the literal : (58₁₀ / 72₈ / 3A₁₆)

Character Class[0-9a-z]*?

*?matches any number of characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

a-zone character from a (97₁₀) to z (122₁₀) (case insensitive)

Character Class[\)\]]+

+matches at least one character from the set below:

\)the literal ) (41₁₀ / 51₈ / 29₁₆)

\]the literal ] (93₁₀ / 135₈ / 5D₁₆)

Positive Lookahead(?=[\s;]+(?:by|with|via|id|for|;)\s*?)

Character Class[\s;]+

+matches at least one character from the set below:

\sany whitespace character

;the literal ; (59₁₀ / 73₈ / 3B₁₆)

Non-Capturing Group(?:by|with|via|id|for|;)

1st Alternativeby

bythe literal text by (case insensitive)

2nd Alternativewith

withthe literal text with (case insensitive)

3rd Alternativevia

viathe literal text via (case insensitive)

4th Alternativeid

idthe literal text id (case insensitive)

5th Alternativefor

forthe literal text for (case insensitive)

6th Alternative;

;the literal ; (59₁₀ / 73₈ / 3B₁₆)

\s*?any whitespace character, repeated any number of times

2nd Alternative\s+by\s+(?<byv>.*?)(?:\s+?$(?:[a-z\-\.]*?\s+)*?\[?(?<byip>(?:(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+))*\]?$?)?(?=[\s;]+(?:from|with|via|id|for|;)\s*?)

3rd Alternative\s+via\s+(?<via>[a-z0-9\.\s]*?)(?=(?:\s*;|[\s]+(?:from|by|with|for|id|;))\s*?)

4th Alternative\swith\s+(?<protocol>(?:.|\s)*?)(?=(?:\s*;|[\s]+(?:from|by|via|for|id|;))\s*?)

5th Alternative\s+id\s+(?<id>[^\s;]+)(?=(?:\s*;|[\s]+(?:from|by|via|with|for|;))\s*?)

6th Alternative\s+for\s+<?(?<for>[^\s;>]+)>?(?=(?:\s*;|[\s]+(?:from|by|via|with|id|;))\s*?)

7th Alternative;\s+(?<date>[a-z]{3},\s+[0-9]{1,2}\s+[a-z]{3,4}\s+[0-9]{4}\s+[0-9]{2}\:[0-9]{2}\:[0-9]{2}\s+(?:-[0-9]{4}\s+)?(?:$[a-z]+$|\+[0-9]{4}))?\n?

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

i modifier: insensitive. Matches without distinguishing uppercase and lowercase letters

Search reference

Regular Expression

(?:\sfrom\s+(?<from>[^\s*]+)[\s]*(?:(?:[\[\(.]?(?<fromh>.*?)?\.?\ *?[\[\(]?(?<fromip>(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+)?[\)\]]+)?)(?=[\s;]+(?:by|with|via|id|for|;)\s*?)|\s+by\s+(?<byv>.*?)(?:\s+?\((?:[a-z\-\.]*?\s+)*?\[?(?<byip>(?:(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+))*\]?\)?)?(?=[\s;]+(?:from|with|via|id|for|;)\s*?)|\s+via\s+(?<via>[a-z0-9\.\s]*?)(?=(?:\s*;|[\s]+(?:from|by|with|for|id|;))\s*?)|\swith\s+(?<protocol>(?:.|\s)*?)(?=(?:\s*;|[\s]+(?:from|by|via|for|id|;))\s*?)|\s+id\s+(?<id>[^\s;]+)(?=(?:\s*;|[\s]+(?:from|by|via|with|for|;))\s*?)|\s+for\s+<?(?<for>[^\s;>]+)>?(?=(?:\s*;|[\s]+(?:from|by|via|with|id|;))\s*?)|;\s+(?<date>[a-z]{3},\s+[0-9]{1,2}\s+[a-z]{3,4}\s+[0-9]{4}\s+[0-9]{2}\:[0-9]{2}\:[0-9]{2}\s+(?:-[0-9]{4}\s+)?(?:\([a-z]+\)|\+[0-9]{4}))?\n?)

New

Received: from VE1PR01MB5599.eurprd01.prod.exchangelabs.com 
            (aze [2603:10a6:7:7c::43]) by HE1PR0102MB2714.eurprd01.prod.exchangelabs.com with HTTPS via HE1PR0402CA0054.EURPRD04.PROD.OUTLOOK.COM with toto; Thu, 9 Jan 2020 16:34:13 +0000

Received: from relay-in.ohc.cu (relay-in.ohc.cu [127.0.0.1])
    by relay-out.ohc.cu (Postfix) with ESMTP id 69EA722DD
    for <some.email@some.domain>; Thu,  9 Jan 2020 11:29:43 -0500 (CST)

Received: from correo.patrimonio.ohc.cu (unknown [192.168.229.20])
    by relay-out.ohc.cu (Postfix) via hello with ESMTP id B83BA22F5
    for <some.email@some.domain>; Thu,  9 Jan 2020 11:29:36 -0500 (CST)

Received: from correoweb.patrimonio.ohc.cu (unknown [192.168.229.23])
    by correo.patrimonio.ohc.cu (Postfix) with ESMTPA id EC62A232A00A;
    Thu,  9 Jan 2020 11:39:53 -0500 (CST)

Received: from VE1PR01MB5599.eurprd01.prod.exchangelabs.com
 (2603:10a6:7:7c::43) by HE1PR0102MB2714.eurprd01.prod.exchangelabs.com with HTTPS via HE1PR0402CA0054.EURPRD04.PROD.OUTLOOK.COM; Thu, 9 Jan 2020 16:34:13
 +0000

Received: from VI1PR0102CA0029.eurprd01.prod.exchangelabs.com
 (2603:10a6:802::42) by VE1PR01MB5599.eurprd01.prod.exchangelabs.com
 (2603:10a6:803:11f::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2602.12; Thu, 9 Jan
 2020 16:34:13 +0000

Received: from DB5EUR01FT034.eop-EUR01.prod.protection.outlook.com
 (2a01:111:f400:7e02::203) by VI1PR0102CA0029.outlook.office365.com
 (2603:10a6:802::42) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2623.9 via Frontend
 Transport; Thu, 9 Jan 2020 16:34:13 +0000

Received: from relay-out.ohc.cu (200.55.138.44) by
 DB5EUR01FT034.mail.protection.outlook.com (10.152.4.246) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.2623.9 via Frontend Transport; Thu, 9 Jan 2020 16:34:12 +0000

Received: from relay-in.ohc.cu (relay-in.ohc.cu [127.0.0.1])
    by relay-out.ohc.cu (Postfix) with ESMTP id 69EA722DD
    for <some.email@some.domain>; Thu,  9 Jan 2020 11:29:43 -0500 (CST)

Received: from relay-out.ohc.cu ([127.0.0.1])
    by relay-in.ohc.cu (relay-in.ohc.cu [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 7CZku5Y59vGC for <some.email@some.domain>;
    Thu,  9 Jan 2020 11:29:38 -0500 (CST)

Received: from correo.patrimonio.ohc.cu (unknown [192.168.229.20])
    by relay-out.ohc.cu (Postfix) with ESMTP id B83BA22F5
    for <some.email@some.domain>; Thu,  9 Jan 2020 11:29:36 -0500 (CST)

Received: from localhost (localhost.localdomain [127.0.0.1])
    by correo.patrimonio.ohc.cu (Postfix) with ESMTP id 65413232A001
    for <some.email@some.domain>; Thu,  9 Jan 2020 11:40:05 -0500 (CST)

Received: from correo.patrimonio.ohc.cu ([127.0.0.1])
    by localhost (correo.patrimonio.ohc.cu [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id hNMp-6lHHtzH for <some.email@some.domain>;
    Thu,  9 Jan 2020 11:40:05 -0500 (CST)

Received: from correoweb.patrimonio.ohc.cu (unknown [192.168.229.23])
    by correo.patrimonio.ohc.cu (Postfix) with ESMTPA id EC62A232A00A;
    Thu,  9 Jan 2020 11:39:53 -0500 (CST)

Regular Expressions 101

Regular Expression

Extraction