← GalleryREGEX for parsing Received value in email headers (RFC822)✨ Emoji Combos/(?:\sfrom\s+(?<from>[^\s*]+)[\s]*(?:(?:[\[\(.]?(?<fromh>.*?)?\.?\ *?[\[\(]?(?<fromip>(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+)?[\)\]]+)?)(?=[\s;]+(?:by|with|via|id|for|;)\s*?)|\s+by\s+(?<byv>.*?)(?:\s+?\((?:[a-z\-\.]*?\s+)*?\[?(?<byip>(?:(?:[0-9a-z]*?[\.\:]+[0-9a-z]*?)+))*\]?\)?)?(?=[\s;]+(?:from|with|via|id|for|;)\s*?)|\s+via\s+(?<via>[a-z0-9\.\s]*?)(?=(?:\s*;|[\s]+(?:from|by|with|for|id|;))\s*?)|\swith\s+(?<protocol>(?:.|\s)*?)(?=(?:\s*;|[\s]+(?:from|by|via|for|id|;))\s*?)|\s+id\s+(?<id>[^\s;]+)(?=(?:\s*;|[\s]+(?:from|by|via|with|for|;))\s*?)|\s+for\s+<?(?<for>[^\s;>]+)>?(?=(?:\s*;|[\s]+(?:from|by|via|with|id|;))\s*?)|;\s+(?<date>[a-z]{3},\s+[0-9]{1,2}\s+[a-z]{3,4}\s+[0-9]{4}\s+[0-9]{2}\:[0-9]{2}\:[0-9]{2}\s+(?:-[0-9]{4}\s+)?(?:\([a-z]+\)|\+[0-9]{4}))?\n?)/gmiJavaScript+13 years ago✓ Pre-loaded
About this regex
Parses the 'Received' header from email headers (RFC822/RFC5321) into named capture groups: sending host (from), sender IP (fromip), receiving server and IP (byv/byip), via path, transport protocol (with), message ID, recipient (for), and the relay timestamp/date. Lookaheads delimit each clause by the next keyword (from, by, with, via, id, for) or semicolon. Useful for email forensics, tracing delivery hops, and spam filtering.
