$re = '/Authentication-results:.+?sender IP.+\R?.+?mailfrom=(.+?);/u';
$str = 'Return-path: <JaneSmith@SomeDummyCo.com>
Received: from ms11p00im-qufv17093501.mac.com ([17.58.36.64])
by ms24534.mac.com
(Oracle Communications Messaging Server 8.0.1.3.20170906 64bit (built Sep 6
2017)) with ESMTP id <0PE4008Z5RC0PLA0@ms24534.mac.com> for
JohnDoe@icloud.com; Mon, 27 Aug 2018 17:31:12 +0000 (GMT)
Original-recipient: rfc822;JohnDoe@icloud.com
Received: from NAM04-SN1-obe.outbound.protection.outlook.com
(mail-eopbgr700137.outbound.protection.outlook.com [40.107.70.137])
by ms11p00im-qufv17093501.me.com
(Oracle Communications Messaging Server 8.0.2.2.20180531 64bit (built May 31
2018)) with ESMTPS id <0PE400K2IRBZ4F00@ms11p00im-qufv17093501.me.com> for
JohnDoe@icloud.com (ORCPT JohnDoe@icloud.com); Mon,
27 Aug 2018 17:31:12 +0000 (GMT)
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0
clxscore=1005 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0
bulkscore=0 classifier=clx:Deliver adjust=0 reason=mlx scancount=1
engine=8.0.1-1807170000 definitions=main-1808270184
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,,
definitions=2018-08-27_07:,, signatures=0
Authentication-results: ms11p00im-qufv10093201.me.com; dmarc=none
header.from=apoemail.us
Authentication-results: ms11p00im-qufv10113901.me.com; spf=pass
(ms11p00im-qufv10113901.me.com: domain of JaneSmith@SomeDummyCo.com designates
40.107.70.137 as permitted sender) smtp.mailfrom=JaneSmith@SomeDummyCo.com
Received-SPF: pass (ms11p00im-qufv10113901.me.com: domain of
JaneSmith@SomeDummyCo.com designates 40.107.70.137 as permitted sender)
receiver=ms11p00im-qufv10113901.me.com; client-ip=40.107.70.137;
helo=NAM04-SN1-obe.outbound.protection.outlook.com;
envelope-from=JaneSmith@SomeDummyCo.com
Authentication-results: ms11p00im-qufv17063001.me.com; dkim=pass (1024-bit key)
header.d=NETORGFT744019.onmicrosoft.com
header.i=@NETORGFT744019.onmicrosoft.com header.b=fYoFciKN
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=NETORGFT744019.onmicrosoft.com; s=selector1-apoemail-us;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=ZUfrOM+P5LAWsuKD/Lnb58GuE4orISbImwlBF3a/vyc=;
b=fYoFciKNtylrXwhibBhDmgiw70cFEaUP4XADRpc2cfX3M/4o94Uc7kMGMdo7wj1KqH/d/ShRSn1YX36qzEnW5yA26XIloXj/bt7iZX2LN5boJlI6OaE6DFUIKivm2Cfvl4Q9wckPQRot76ogx/NeYCwfJvD/OgGybwJWjoLQQJo=
Received: from DM3PR19MB0521.namprd19.prod.outlook.com (10.164.248.145)
by DM3PR19MB0825.namprd19.prod.outlook.com (10.166.164.151)
with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
id 15.20.1080.14; Mon, 27 Aug 2018 17:31:09 +0000
Received: from DM3PR19MB0521.namprd19.prod.outlook.com
([fe80::69c8:8da3:dc38:8caa]) by DM3PR19MB0521.namprd19.prod.outlook.com
([fe80::69c8:8da3:dc38:8caa%5]) with mapi id 15.20.1080.015; Mon,
27 Aug 2018 17:31:09 +0000
From: John Doe <JaneSmith@SomeDummyCo.com>
To: John Doe <JohnDoe@icloud.com>
Subject: AutoResponder - Acme Inc - New Client Questionnaire - - Steven
Plain Text TEST 03/12/1971
Thread-topic: AutoResponder - Acme Inc - New Client Questionnaire - -
Steven Plain Text TEST 03/12/1971
Thread-index: AQHUPiu+8RdF6Tdpg0SO88Zlg/iLzQ==
Date: Mon, 27 Aug 2018 17:31:09 +0000
Message-id: <D7A99F58.1E1AA%JaneSmith@SomeDummyCo.com>
Accept-Language: en-US
Content-language: en-US
X-MS-Has-Attach:
Authentication-results: spf=none (sender IP is )
smtp.mailfrom=JaneSmith@SomeDummyCo.com;
X-Originating-IP: [98.195.128.79]
X-Microsoft-Exchange-Diagnostics:
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php