SPF logic

I set up SPF for my domains, which has been in place for quite a while.

I recently set up incoming SSL/TLS + authentication for customers' emails.

I am finding now that remotely connected customers (such as those away 
on holidays) are being denied by the SPF rules because they are no 
longer on a local subnet, and now filtering in to the SPF rules.

I am wondering what logic I need to put in place to let them bypass the 
SPF if they come in by local SSL authentication ? I can't quite reason 
it out. Thanks for any suggestions/advice.


-- 
Jim Pazarena         fquest@paz.bz
Haida Gwaii - British Columbia - Canada