SFDC Opt-Out field on the Lead and Contact Objects is mapped to the Marketo Unsubscribed field.
Whenever a sales rep checks the SFDC Email Opt Out box, the Lead will be unsubscribed in Marketo.
If the Unsubscribed field in Marketo changes to false the Email Opt Out field in SFDC will change as well.
Marketo has a “True opt-out” policy. If one record is unsubscribed, Marketo will automatically unsubscribe all records with a matching email address. The data value change will be noted in the Marketo activity log for each of the records.
If you delete the unsubscribed record from Marketo, when a new lead is created in Marketo from any source (e.g. inserted via SFDC or API, form submission, list import or manually created, we check it against your Marketo instance master email status table. If the lead was unsubscribed when you deleted it in Marketo, we will update the record to be unsubscribed. If you set Unsubscribed to false using a hidden field on the form or smart campaign the master email status table will be updated. Thus, if you delete the record and Unsubscribed is false and the record is created again in Marketo the Unsubscribed field will remain false.
Here is a great article about durable unsubscribes by Raul Fonseca.
Please check out the community for the different ways to re-subscribe records in Marketo for records caught by the durable unsubscribe rule.
Additional resources for learning about the Marketo integration with SFDC.