Something like this should work
Code:
/^Received: from .* (by zimbra\.domain\.com .*)/ REPLACE /Received: $1/
sorry but unable to test it until later. In theory that should grab everything from zimbra.domain.com onwards and then replace it in the new header.