<?php

$data = "from remote.intra.domain.net (sbs-2011.intra.local [0.0.0.0]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mailhost.domain.net (Postfix) with ESMTPS id A2E067029D9 for <john.doe@domain.net>";

function extractComments($data)
{
    $comments      = [];
    $index         = null;
    $parensCounter = 0;

    foreach(str_split($data) as $char)
    {
        if($char == '(' && !isset($index))
        {
            $index = count($comments);
            $comments[$index] = '';
        }
        else if($char == '(')
        {
            $parensCounter++;
            $comments[$index] .= $char;
        }
        else if($char == ')' && $parensCounter != 0)
        {
            $parensCounter--;
            $comments[$index] .= $char;
        }
        else if($char == ')')
        {
            $parensCounter = 0;
            $index = null;
        }
        else if(isset($index))
        {
            $comments[$index] .= $char;
        }
    }

    return $comments;
}

function extractDomain($data)
{
    $matches = [];

    preg_match('#from\s(.+)\s+#U', $data, $matches);

    return $matches[1];
}

var_dump(array_merge([extractDomain($data)], extractComments($data)));