This rule shuld add bad scores to machines which don't talk rfc.
Her is my try which doesn't succeded.
header MY_RECV_FQDN1 Received =~ /^from [a-zA-Z0-9-]+ (\w+ \w+) by hostname\d\d\.domain\.com
describe MY_RECV_FQDN1 Sender does not use FQN in EHLO
score MY_RECV_FQDN1 5
Is it a problem, that the received-line is broken up in two lines?
No, but you do need the /s regex modifier at the end to get the regex to work with multiple lines and treat newlines as spaces.
Right now it looks like you're missing the trailing / entirely, which is a syntax error.
Might I suggest ending with /si. (newlines to Spaces, and Ignore case)
