sf ver: v2.7.1.532 listening on 25 - ip: xx.xx.32.31
mail server: mailenable listening on 26 - ip: xx.xx.32.31 (same server)
54 domains all added to "Local Domains"

customer sends mail from outlook client using smtp auth with their domain. They cannot send email to local or external domains. It seems to be blocking the mail because the IP their ISP is giving them is blacklisted. Why is this happening? How can I prevent it?

08/20/06 14:12:16:406 -- (1136) Connection from: xx.xx.116.202  -  Originating country : United States
08/20/06 14:12:16:828 -- (1136) Resolving xx.xxx.116.202 - cpe-xx-xxx-116-202.xxx.xx.rr.com
08/20/06 14:12:16:828 -- (1136) - SPF analysis for sender@sendersdomain.com done: - none
08/20/06 14:12:16:828 -- (1136) Mail from: sender@sendersdomain.com
08/20/06 14:12:17:078 -- (1136) - MAPS search done... 521 The IP xx.xxx.116.202 is Blacklisted by dnsbl.sorbs.net. Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?xx.xxx.116.202
08/20/06 14:12:17:093 -- (1136) xx.xxx.116.202 - Mail from: sender@sendersdomain.com To: recipient@recipientdomain.com will be rejected
08/20/06 14:12:17:359 -- (1136) EMail from sender@sendersdomain.com to recipient@recipientdomain.com was received and quarantined. Size: 5 KB, 5120 bytes
08/20/06 14:12:17:421 -- (4052) Time to add Msg to Bayes corpus:0
08/20/06 14:12:17:437 -- (1136) Blacklist cache - Updated limbo counter for 72.228.116.202
08/20/06 14:12:17:437 -- (1136) Disconnect

SpamFilter by default denies any attempt to relay emails to domains that are not in its list of "Local Domains".

Prior to v3.1, the only way to allow users to use SpamFilter as their "outgoing smtp server" is to add the IP(s) of the users in an IP whitelist. This will allow users to send emails to any domain, and to avoid being blocked. In your example, SORBS correctly blocked the user as SORBS blocks any dynamic IP. Please note that even if the client has smtp auth enabled, it's not supported in your version of SpamFilter.

Starting with SpamFilter 3.1, we added support for SMTP auth (including SSL encryption). Active Directory, LDAP, and Unix-style passwords can be used to authenticate senders. If a sender is authenticated successfully, they will be whitelisted and allowed to relay.

Yes, the configuration you described will work just fine!
As a side note, while we do not have the latest version available as a "free" test download, if you wish to try it please contact us at sales at logsat dot com, we'll be able to help.