$re = '/^X-Mimecast-Spam-Score\: \b([7-9]|[12][0-9])\b\nX\-Mimecast\-Spam\-Signature\: yes$/m';
$str = 'MIME-Version: 1.0
X-Mailer: WebService/1.1.19306 YMailNorrin
Authentication-Results: relay.mimecast.com;
dkim=pass header.d=yahoo.com header.s=s2048 header.b=XXXXXX;
dmarc=pass (policy=reject) header.from=yahoo.com;
spf=pass (relay.mimecast.com: domain of XXXXXX@yahoo.com designates 106.10.241.82 as permitted sender) smtp.mailfrom=XXXXXXXXXX@yahoo.com
X-Mimecast-Spam-Score: 15
X-Mimecast-Spam-Signature: yes
Content-Type: multipart/alternative;
boundary="----=_Part_966462_2108451314.1637042911940"
Content-Length: 55093';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php