Skip navigation
All Places > Champion Program > Blog > 2016 > March

What is DMARC?


Domain-based Message Authentication, Reporting & Conformance, or DMARC, is an email authentication standard introduced in 2012 to determine how unauthenticated email should be handled. It adds a third layer upon SPF and DKIM to create a holistic email confidence system. So, what does that mean? First, let's back up a bit.


Whenever anyone sends an email from a certain domain, SPF and DKIM records need to be set up on the domain's DNS server—it’s a way for email servers to say “it’s OK that this service (whether that's your office email, Marketo, a web server, etc.) is emailing with an address that has my domain: they’re with me.” 


The best way to think of SPF and DKIM is to think of SPF as the “envelope” (the original piece of data being sent over) and DKIM as the signature (the letter inside—is it forged or original?) SPF is a public declaration given by a domain; DKIM requires both a public and private key. The two work in tandem to prove an email is legitimate. DMARC builds upon this system by giving mail servers instructions on what to do when it finds emails that don't have correct SPF and/or DKIM records: should it let them through, quarantine them, or reject them? Additionally, DMARC is set up so the servers you email to will provide you a report on what emails are being sent with your domain—and if there's anyone sending rogue emails with your domain (say, for phishing purposes.)


While this is exciting stuff for IT, why should marketing care? Simply put, more and more email providers are now checking to make sure you have a DMARC policy to determine whether your email is considered spam—even if you have SPF and DKIM records defined! At DemandLab, we have seen examples of AOL, Yahoo and private email firewalls now rejecting emails due to a lack of a DMARC record. Defining a record is a win-win: your marketing messages are considered more trustworthy, and your users have the security of knowing anything coming from your email domain is legitimate.


How do I set up DMARC for my email domain?


You can check if your email domain currently has a DMARC policy by visiting If your company doesn't have any record on file, we recommend a five-step approach to make sure your implementation goes smoothly:


1. Take an inventory of your emailing systems


Your company's technology stack probably has more things sending out email than you'd think—there's more to consider than just your office email and marketing automation! Consider transactional emails, emails sent from internal programs, emails from other SaaS platforms, and more. We recommend working with your IT team to look across your entire technology stack to make sure you have everything covered.


2. Check that all the systems you identified have SPF/DKIM definitions


For many marketers, the process of setting up SPF and DKIM when you first purchase your marketing automation platform is the first (and last!) time they ever think about these records, but it's important to consider how all other outgoing email is defined with SPF and DKIM records.


Make sure you have all IPs and/or record types defined with your SPF setup. It's important to remember that the SPF standard can only handle 10 lookups, so if you have more than 10 different places sending emails with your domain, you may want to consider consolidating your email sources or purchasing a separate domain for certain types of emails.


From there, you need to ensure you have DKIM records set up for each of your mailing platforms—your IT team should be able to help you see which TXT records have different DKIM signatures on them and what you may be lacking. Because some administrators aren't as familiar with DKIM setup, there's a very real possibility not all of your mailing systems are covered. Included below are setup instructions for setting up DKIM on some of the most common email systems:



Office 365:


Google Apps:

Linux servers (Postfix):


3. Create an email account for receiving DMARC reports


DMARC requires an email address to send its authentication reports to; most commonly this address is either or (which I strongly recommend for your own DMARC setup over custom options, since many feedback loop systems prefer these names.) Make sure you have a valid email inbox for these records that go to both IT and marketing. Do note that if you use Google Apps the process is a little different than most email providers.


4. Define what you want your DMARC policy to be


DMARC gives domains a few different options on how to handle emails that don't pass authentication (those interested in learning all potential configurations should check out this helpful overview of all DMARC tags and values.) For simplicity's sake, we'll define three main options: take no action, quarantine, or reject.


A very basic example of a DMARC record where servers are instructed to take no action would be:

v=DMARC1; p=none;;


Generally, we recommend a phased approach where your DMARC policy over time where your policy (defined above as none via p=none) is slowly changed over time to be increasingly more restrictive—changing your record over time to have 10% quarantine, 25% quarantine, 50% quarantine, 75% quarantine and an eventual p=reject policy (where any emails that don't have SPF/DKIM authentication should be discarded altogether.) However, it's usually best to do an analysis of your DMARC reports before implementing stricter measures.


5. Set your DMARC policy (and monitor your reports!)


Once you've determined what your DMARC record should be, have your IT team place it as a TXT record in your domain's DNS manager. After applying this record, you should start to receive daily emails to the email address you chose that look similar to the following:




Attached to each of these emails will be an XML report that details what that particular email provider has experienced. By breaking down the the XML tags included in each of these reports, you can get a better idea



In this particular report from Yahoo, we can see the following:

  • The policy for this domain is to take no action (<policy_published> tag with <p> inside set to none)
  • 19 emails were sent to Yahoo’s servers on this day (<count> tag)
  • Emails sent from an IP passed SPF/DKIM (<record> tag)
  • Emails from passed DKIM (first <domain> tag inside <auth_results>)
  • Emails from passed SPF (second <domain> tag inside <auth_results>)


This is an example of a healthy DMARC setup, but how do you know when something's wrong? By looking at the recent results report of a company that has a 20 percent quarantine policy, we can learn what to watch out for: a record that has failed authentication, yet is still being delivered.




Failed but not quarantined















Since both <dkim> and <spf> tags say fail, we know that this particular IP did not meet DMARC policy. Additionally, when we look at this record, the <type>sampled_out</type> tag lets us know that even though this record was flagged for not passing DKIM or SPF, this one email was allowed to still be sent since it was not part of the 20 percent quarantine.


If you look up the IP, you'll find it's actually a Polish spammer on many blacklists already. Therefore, in this case this spam bot is sending emails out of its system using this company's domain as an email address! Because this and several other similar records showed up for this company, they should probably consider moving to a higher percentage of quarantining more quickly. You'll know when these emails aren't delivering when you see your <policy_evaluated> tag looking like this:









With this in mind, be sure to watch your reports over the next few weeks and check that you do not see any <result>fail</result> messages, which would point to a specific domain or IP failing that you want your emails to be sent from—and make sure that you don't see any records of senders you don't want sending messages getting through.


DMARC is not just an IT responsibility, especially when your email deliverability is hanging in the balance. Marketers should be involved throughout the entire DMARC setup and implementation process. Together with the IT team, marketers must do periodic checkups on the reports to ensure that your email continues to deliver as it should, and you can enjoy knowing that your email is safer, more deliverable, and unspoofable.

Every company wants more marketing qualified prospects feeding the Sales team. However, a funny thing can happen with organizations that leverage Salesforce–A Lead can get converted into a Contact and never get seen again, almost like George Clooney in Gravity.


The end result is significant lead leakage and wasted investment as these Contacts can fall out of the funnel. Luckily, Marketo treats these two objects as one to help this process.

Does your company convert Leads into Contacts without adding them to an Opportunity? If so, what are you doing to make sure these prospects are not lost in space? In this post, I’ll cover some of the top lifecycle issues many companies face around this situation and what you can do to bring your prospects back to earth.

Salesforce: Lead vs Contact


The Contact and Lead terminology within Salesforce can be a bit tricky. Remember that Salesforce was founded way back in 1999 back when Napster was founded–heck, we couldn’t figure out the MP3 process, never mind a closed loop marketing and sales system. In Salesforce, a Lead is someone who needs to be worked–a Contact is someone who is known and belongs to an Account (Which may or may not have an Opportunity).  The issue is Salesforce treats Leads and Contacts differently, which poses all kinds of tracking and lead flow process issues.

Marketo doesn't care about different objects. A Lead in Marketo can be either a Lead in Salesforce or a Contact in Salesforce. There is a flag that you can use to determine the difference. This is why companies can easily report across Leads and Contacts in Marketo.

Confused yet? The relationship between them all is kind of like the old Abbott & Costello Who’s on First routine.

For a full explanation, see Salesforce MVP Shell Black’s in-depth white board breakout.

Your Lifecycle: Where Contacts Get Lost


Are Your Contacts a Permanent Detour?

The typical situation looks something like this. A person from a major brand like Disney fills out a Marketo form for an eBook and becomes a Lead. The Business Development Representative (BDR) sees that hot activity and then adds that person to the Disney Account as a Contact. This allows the appropriate Account Executive (AE) to manage it accordingly. This process sounds good in theory but it can cause a whole host of issues.

The big disconnect here is that the Contact has no associated Opportunity in Salesforce. Because Marketing tends to measure Leads while Sales tends to measure Opportunities, a Contact without an Opportunity can fall out of vision and that’s not a good thing. Don’t think these numbers are significant? I’ve seen 30% or more Contacts that don’t have Opportunities.

A Few Examples of Lost Contacts

  • Lack of Follow-Up: AEs aren’t BDRs. I’ve seen it time and time again like a broken record. A Lead gets converted to a Contact and gets assigned to a BDR. BDRs are supposed to call the person X times but because the person is part of an existing account, the BDR reassigns it to an AE. Because many companies only have service level agreements and Marketo alerts trigger for Leads, the prospect falls off the radar as it’s technically a Contact.
  • Poor Nurture Communications. Often a new Lead drops into a Marketo nurture track for email communications. What happens if a new Contact is added? Or if a Lead is converted to a Contact? Will this person receive any communications at all? Will the person receive a generic email communication even though it belongs to an Account? For example, shouldn’t a person from a top Account like Disney receive a different communication?
  • Lost in System. Let’s say your company hosts an awesome webinar with 500 attendees? 100 Leads hit a lead score threshold and your Marketo lifecycle model passes the person over to the BDR team. What happens to the Contacts that are sitting in the system that were already passed to AEs? Because the Contacts are sitting outside the process, many times they don’t receive any followup. That’s a huge opportunity lost.
  • Where’s the Upsell? Big companies tend to work on a departmental/divisional level. For example, a person from Disney Interactive most likely doesn’t know what’s going on at Disney Consumer Products. If none of the above are handled properly, that upsell/cross-sell opportunity could get lost.
  • Salesforce Doesn’t Make it Easy. Salesforce has all kinds of lead queue views that help Sales manage Leads. Contacts are a whole other ballgame and must be managed separately via reports using standard Salesforce processes. Marketo simplifies some of these insights by offering reports that let you see Lead and Contact activity in one report. However, if Sales doesn't work Contacts appropriately, those Contacts will stick out in Marketo as a reflection of poor process.

Stop the Leaking Funnel

So where do you turn? Let’s dive into a few approaches that can help reduce those Contacts leaking out of your funnel.

Develop a Unified Salesforce Lead & Contact Model


Technically, Leads and Contacts are different but this approach treats them the same.

This approach uses a single field that ties both Leads and Contacts together. Let’s call it the Lifecycle field. For companies that work Leads and Contacts in parallel, this process gives more flexibility and better management.


Here, reps and marketing focus on the Lifecycle field to manage prospects through the funnel, ignoring whether or not the person is a Lead or a Contact. Only Contacts can have a Won or Opportunity stage. For example, if a Lead with a Lifecycle status field value of “Sales Accepted” is converted to a Contact, it will still maintain its Lifecycle status value. This will allow the rep to work that Contact just like a Lead.


From a Marketo perspective, the lifecycle is simplified. Marketing can deliver content and run reports against the Lifecycle status in Marketo because those statuses will be consistent across Leads and Contacts. It really doesn’t matter if the person is a Lead or a Contact because the Marketo Lifecycle status treats the person the same. For organizations leveraging the RCA modeler, they can leverage this single field as a trigger for moving people from one stage to another.

Benefits Include:

  • Complete Visibility of Leads and Contacts. Because EVERYONE is now accounted for, fewer prospects will leak out of the funnel. For example, allowing Contacts to hit MQL enables the Sales team to get visibility into their success. Marketers can run MQL reports in Marketo that reflect MQLs sitting as Leads or Contacts. Otherwise they can get lost in the system.
  • Better Experience. Marketing can now have more control over what happens to a person during their lifecycle journey from a nurturing perspective.
  • Not a Permanent Detour. Prospects don’t get stuck in the Contact graveyard. They can recycle back to Sales just like a Lead would.
  • More Cross-sell and Upsell opportunities. Having Contacts MQL and Recycle might uncover completely new opportunities within the same account.
  • Account Building. Let’s say Disney has 100 Contacts in your system. If any of those take action, each will MQL as a Contact individually.

Some Caveats

The approach still doesn’t fix Saleforce’s lack of management for Lead and Contact processes. Companies must develop strong processes for both Lead AND Contact management in order for consistent data to flow to Marketo.

Additionally, reporting across Leads and Contacts in Salesforce is no easy task unless you have some custom built, cross object reporting. Thankfully, Marketo provides insights into the Unified Salesforce Lead & Contact model by letting companies report on Leads and Contacts holistically.

Marketo not enough? Path to Scale’s Performance model from reports combines lifecycle information of Leads, Contacts and Opportunities in a single Salesforce dashboard.  It was developed by Grant Grigorian to fill the reporting gaps that can exist in Marketo and Salesforce.



Path to Scale Salesforce Dashboard combines intelligence from Leads, Contacts and Opportunities.

Account-Based Marketing Approach

Related to the Unified Salesforce Lead & Contact Model, Leads and Contacts are always related to some company. However, only Contacts are tied to Accounts in Salesforce. This can cause lead routing issues and lack of email personalization.

I’ll save this subject for another post but know that several companies such as Lean Data,Engagio, Ringlead and others are developing solutions to address some of these challenges with an account-based approach.

Where to Start-The Verdict

There are many shades of grey when it comes to managing Contacts and Leads. A Unified Lead and Contact approach works in many cases but not all. After deciding if the approach works for your organization, that will result in a big process change.

On the Marketo side, you'll need to update your lifecycle campaigns, scoring programs and more to reflect the change if you go that route.

Which approach works best for your organization? What do you think?

A similar version of this post was originally published on RevEngineInsider.

Nurture Marketing.  Marketo calls it Engagement Programs. Whatever the case, these are the emails designed to keep us informed while we're evaluating our options or waiting to pull the trigger.


In layman's term, spam.  Gmail calls them "Promotions". We call them "Unrequested Marketing Emails." Whatever you want to call them, they do serve a purpose and I have had truly hearfelt feelgood stories about the impact of Nurture Marketing. I've seen them convince people to get medical care instead of sitting around pretending nothing's wrong. I've seen them convince people to buy.  I've bought several times from good nurturing programs.


The problem with creating a Nurture Program is simple: How do you avoid wasting content?


In marketing terms, length matters. Someone who wants to buy your product in July but won't have budget until January needs to feel special and loved.

You can't finish too early.... You can't run out of emails in September and just hope they remembered you.


With that in mind, this blog will show you, step by step, how to create an Engagement Program that conserves content. If they didn't open your email then maybe your subject lines suck. Try it again with a better subject line that hopefully sucks a lot less.  If you've tried twice and they still didn't open, move on and try your next piece of content.


With this, you're potentially DOUBLING the amount of content you have. You're trying to put a prettier bow on the present in hopes they'll open it.



This document will show you how to create conditional sends in an engagement stream.


As you may know, an Engagement Program will allow you to use programs in the streams. The programs are nice because they allow you to use conditions - IF THEN, etc. The problem is that a lead can only be a member of a program in an engagement stream once, so making conditions that allow a lead to skip a step can be difficult. This guide will show you some steps around that problem in a very scalable way.


This example will use the following situation. You can adapt this to your own needs:


Cast 1: Send Email 1

Cast 2: If Opened Email 1, Send Email 2. If Not, Send Email 1b

Cast 3: If Opened Email 2, Send Email 3. If Sent Email 2, Send Email 2b. If Not Sent Email 2, Send Email 2.


One could create a program like this, continuously building upon the complexity. The first time I built my nurture program, this is what I did. When I was asked to shuffle emails around it was an absolute nightmare.


This is not what we will do. We will create an Engagement Program that is far more scalable, easy to understand and easy to manage.


I am not going to go into philosophy behind Nurture Programs. That is another blog I am working on. This will be purely technical as to how to allow emails to be skipped if a person is not eligible to receive it. In this case, every email has an alternate with a different subject line. If they open the main email they are not eligible to receive the alternate.



I like to keep everything very structured and tidy in my Engagement Programs. To follow my example, build out an EP with the following:



1. Assets

2. Workflows

2a. Add to Nurture

2b. Remove From Nurture

2c. Casts


Create this PROGRAM in Workflows

2d. Master Nurture Program

And these folders:

Assign Emails

Email Tracking

Send Email Logic

Chrome Legacy Window 3142016 14404 PM.bmp.jpg


This blog will not get into Add To Nurture, Remove From Nurture, Emails or Landing Pages in detail.


In the email folder, I have all of my email assets: Email 1, Email 1b. Email 2, Email 2b, Email 3, Email 3b, Email 4, Email 4b, etc.


The first step is to create workflows to Assign Emails. This is very basic and simple.


Smart List: Campaign Is Requested

Flow: Send Email (name of email that corresponds to Smart Campaign name).


Chrome Legacy Window 3142016 14724 PM.bmp.jpg


Why we do this step: A lead can only go through a program once and this is logic we'll want to re-use. Also, an Engagement Program will only send an Email once IF if's defined in the stream or the program in the stream. We're tricking Marketo to not realize it's doing that.


Step 2: Define Success Criteria

For this step, we're going to create a smart list that provides what success looks like. These are the reasons why it would make a lead ineligible for an email.

In this example, we're creating a list of reasons why they would be done with the first group of emails - Email 1 and Email 1b and eligible for Email 2.


If they visited the landing page, or...

If they opened Email 1, or...

If they received Email 1b...


They are eligible for Email 2. Until they do one of these three things, they are not eligible.


Chrome Legacy Window 3142016 15307 PM.bmp.jpg


Create criteria for all of your steps. In this case, we're looking to skip over Email 1b if we can. We do that by indicating that they opened Email 1 or visited the associated landing page, or they actually received 1b. Do this for Email 2 and on.


Step 3: Creating Your Email Sending Logic

Now is where we put this all together. This is confusing, so bear with me. You'll need to start at the end point and work your way to the beginning.


Step 1: End Campaign

For all of these steps, Smart List is "Campaign Is Requested". The reason we do everything backwards is that, in each step, the NEXT STEP must by built and activated in order to use it.

I have a stream called "Completed Nurture" which I use to house everyone done with the program. We're just moving them into this stream. Activate the flow.

Chrome Legacy Window 3142016 20356 PM.bmp.jpg


Step 2: Last Touch: "Call 5 or End"

Request Campaign

(You'll have to forgive the screenshots. Marketo prefixes everything with full source name which makes it hard to see.)

Choice 1: If they're a member of the smart list you created to define that they've completed this touch (in this example, they've completed Email 5), Request the End Campaign program we just created.

Choice 2: If they're not a member of the Smart Campaign for Email 5, then request Smart Campaign Email 5.

Default: Send Email 5b


Chrome Legacy Window 3142016 20749 PM.bmp.jpg


Step 3: Call 4

Request Campaign

Choice 1: If they've completed this touch (in this case, an Autodemo) then call "Call 5 or End".

Choice 2: If they're not a member of the Smart Campaign for Email 4, then request Smart Campaign Email 4.

Default: Send Email 4b


Chrome Legacy Window 3142016 21313 PM.bmp.jpg


....Keep doing this until you get to your first touch...


What you just did was define every step along the way of what should happen next. You started at the end because the next step must exist and be active before you can call it.  You can't request Touch 5 until Touch 5 exists, and therefore you can't start at Touch 1 and request Touch 2 because it's yet to exist.  Confusing, I know.


Chrome Legacy Window 3142016 22718 PM.bmp.jpg


OK folks, last things here, I promise....

Now for the easiest part of all.  The cast programs.  These are the programs that will be called for each cast.  This is super simple.


Step 1:

Under your folder 2c. Casts, create a Program called Cast 01.

In the program, create a Smart Campaign called "Call Master Program."

Smart List: Member of Engagement Program (this program).

Flow: Call 1 (this is the last SC you created in the prior step, which send out Email 2, 1, or 1b).


Step 2:

Clone this program for as many total touches as you have. In this case 5 touches * 2 versions of each touch = 10 clones.

Don't change a single thing! Don't change the flow! Don't change the flow! DO NOT CHANGE THE FLOW! Request Call 1 each time.


Chrome Legacy Window 3142016 22546 PM.bmp.jpg



Now, put all of your Casts in your Engagement Program


Chrome Legacy Window 3142016 22833 PM.bmp.jpg


How It Works:


Each week, Call 1 is requested. Call one will see if you've completed this touch and if so, request Call 2.

Call 2 will see if you've completed the touch and if so it'll request Call 3.

Call 3 will see that you haven't completed this touch. You've received Email 3 but didn't click or open the email, so it'll send you Email 3b.


Here's the Activity Log from some tests I ran.  This starts with Email 3 in the chain because Email 2 had a lot of clicks which kill the example. Starting at the bottom, I request Call 1, which was completed as was 2. It send me Call 3.  I opened the email. Now it goes through again and gets to Call 4. I don't open the email. Now it goes through again and sends 4b.


Chrome Legacy Window 3142016 23448 PM.bmp.jpg


So, why does this work? Because we're not sending an email in the Engagement Stream, we're calling Campaigns. And we're not asking it to go through the same program, we're creating a new program that starts at the beginning at goes to the right spot. If you're eligible to skip a communication you do. If you're not eligible, you get it again.




What I have learned over the years is that it becomes really hard and un-scalable to make a new Facebook, Twitter, LinkedIn, or Google AdWords Program in Marketo for every instance of an advertisement of your content. Take for example EverString's State of Predictive Marketing.  I have that running in retargeting, search engine marketing, Facebook, Twitter, LinkedIn, Nurturing, email list rentals, etc etc. That can quickly get out of control with the number of Programs you would need to build.  Multiple that number against the number of new eBooks and reports and the volume of programs to build and keep track of quickly gets out of hand.

Instead I have built "bucket" programs for both the advertising channel and the piece of content. So for example the State of Predictive Marketing Report, if you download that report through an ad from Facebook you will belong to both the Content program AND the Facebook Master Program. To enable this method I created a Campaign Type in SFDC called "Content" and a Channel tag in Marketo called "Content".  Then whenever we publish a new report, ebook, case study, video, cheatsheet, etc, a program and corresponding SFDC campaign is built to track all the visits and downloads of that content.

Here is a screenshot of our folder for all our content pieces.  All downloads across all channels are recorded in these programs. We can then easily run reports on total number downloads of a piece of content, pipeline sourced, pipeline influenced by the content.  Previously, I had the content spread across 20+ different campaigns and I had a really hard time calculating how many times a piece had been viewed.



Then here is a screenshot of on of our the advertising bucket programs.  The smart campaign to belong to this program listens for the URL of the landing page to contain Facebook in the query string.  I just know that when I'm creating an ad on Facebook, the URL of the landing page needs to contain the UTM of “Facebook” and this smart campaign will react.



Here is a screenshot of my Google Adwords program.  I clone these every quarter so that I can enter in new period costs based on how much we spent in that channel.





The UTM fields can get replaced time over time as a lead interacts with more content. The smart campaign inside the Marketo program listens for the different values in the UTM_campaign= xyz to give each piece of content and campaign credit.


So for example if the landing page is posted to facebook the value for UTM_campaign=Facebook. But if the landing page is posted to an external email campaign in MarketingProfs, the value will be "12-2-marketingprofs".  Examples of URLs I have in use:

The end result is that as a team we can track how content performs with multi-touch attribution and see if the content's impact at different stages of our funnel. 

How are you tracking content success across your channels and programs?

List imports are scary stuff.


There are a lot of things that can go wrong with pushing a file of leads into your database. Duplicates. Overwritten values. Bad data. List imports open you up to a lot of risk to your Marketo database all at once.


But you can set up a line of defense for your more sensitive fields using what I call “proxy fields”, which help you intelligently manage how data is overwritten.


List imports are a daily task for us, and so we’ve gotten pretty strict on the data requirements for new leads, particularly with the lead status field. When we upload, we need to be able to distinguish between suspects/inquiries and truly qualified leads.


We block field updates for the lead status field, meaning it only accepts the first value from a list import, and won’t be changed by future imports. This helps us ensure a lead that’s already an MQL cannot move backwards and become a suspect from a later list import.


This is handy, but field blocking is a double edged sword. Suppose a lead was originally imported as a suspect, but is now on an import list where we’ve marked them as an MQL. In that case, we actually want them to become an MQL, but since that field blocking is in place, that lead’s status won’t be changed, and we’d be forced to fix it manually.


To work around this, we created a proxy field, called “Import Lead Status.” It replaces the standard lead status field on our import lists, and more intelligently manages the data, making sure leads can move forward in status, but not backwards.


Here’s how to set it up in about 10 minutes:


  • Create a new text field with a name distinct from the original field (this should be a marketo-only field), such as “Import Lead Status.” Ensure no field updates are blocked. You may also want to set a few list import aliases for this field, as this is the field you’ll want all your list imports to map to in the future.
  • Create a smart campaign set to run every time a lead qualifies, with two triggers: one for anytime your new field’s value changes, and another for when the lead is created (since data value change triggers won’t fire for new leads). You’ll also want to include two filters:
    • A filter to exclude any lead statuses you do not want to change. You need to include this so your import lead status doesn’t move any leads backwards inadvertently. I decided that anything Marketing Qualified or beyond (SAL, SQL, etc) shouldn’t be changed.
    • A filter the specifies that the import lead status field isn’t empty (for the aforementioned “lead is created” trigger)
  • For your new Smart Campaign’s flow, you just need one step, “Change Data Value” that sets the lead status by grabbing the value from the proxy field, using a field token.


The nice thing about this process is it’s invisible to your other Marketo users. We have a standard import template that we require for any list uploads, and I have “lead status” and variations of it mapped to this proxy field as a safeguard, so to anyone importing lists, this is no different to how they managed the process before. Since implementing this process, it’s had a big impact on efficiency and accuracy for us.


Obviously this is just one example of a proxy field – you could do something similar for geographic fields, company names, phone numbers, and much more. If you’re doing something similar, I’d love to hear about it!


This post originally appeared on

This post it to elaborate some strategies to handle the "sync with Marketo", based on the findings we had on how this field really work ("Sync with Marketo" mysteries part 1)


If you want to prevent some leads to be sync'ed to Marketo from the early beginning

Just set the "Sync with Marketo" to False in SFDC before enabling the sync. In the initial sync process, stop at the field mapping step, ask Support to enable the filter and, when it's done, complete the sync.


If you want to progressively expand the set of contacts and leads to be sync'ed

This may be needed for a progressive roll out in large orgs.

Start with disabling ("Sync with Marketo" = False) for everything in SFDC and progressively set the "Sync with Marketo" field to True for the BU's or geographies you want to activate.


If you want to deactivate the sync on some existing and already sync'ed leads / contacts before deleting them in Marketo

From our findings, the first way you should consider to set this up is to stop the sync FROM Marketo. Unchecking the "sync with Marketo" will propagate to SFDC at next sync, and from there, the sync will stop. So the smart campaign to set up to do this is:

  • Trigger: whatever event that should cause to stop syncing
  • Flow :
    • Change data value. Attribute = "Sync with Marketo", New value=False
    • Sync to SFDC
    • Delete lead

The "sync with SFDC" flow step is not mandatory, you may just rely on the automatic sync to happen. Still, having this step in the flow enables to make sure that the sync has occurred before deleting the lead. If you do not use a "Sync to SFDC" step, insert a "wait 1 hour" instead.


If for various reasons, you do not want to use Marketo to stop the sync but you want to do it in SFDC, then use a time based workflow so that the "sync" field is not unchecked immediately. This will leave time for the other value changes to be propagated to Marketo, where you will be able to use these value changes to ultimately delete the lead, after another wait of 2 hours.

T0Lead/contact values are edited and trigger a Time based workflow for 1 hour
T0+5mnOn sync, the values are also changed in Marketo to reflect the changes from SFDC. Trigger a smart campaign to delete the lead, but start by waiting 2 hours
T0+1hEnd of the TBW. The "sync to Marketo" field is set to False
T0+1h 5mnThe sync stopsThe sync stops.
T0+2h 5mnEnd of the wait, the lead is deleted



If you want to reactivate the sync on leads/contacts that have stopped to sync

You do not have a choice here: the only place you can do this is in SFDC, even if you have not deleted it yet from Marketo.



One common question is : how do I restrain some records from flowing from SFDC to Marketo when that cannot be handled with simple Salesforce sharing rules. For instance, making sure that inactive contacts or even contacts without emails do not pack into the Marketo DB and count against the licence. The answer is often to add a "Sync with Marketo" field and use it to filter out some records.


But the devil is in the details, so we ran a comprehensive test on how the "Sync with Marketo" really works and came back with a few interesting findings.


Finding #1: the only value of the field that matters is the one from SFDC.

I had read it already from Support, but, as St Thomas, we did some testing to verify it: if the field have a value on SFDC and another one in Marketo, on a same lead / contact, the value that determines whether or not the sync will happen is the one from SFDC. So if the field is set to "True" in SFDC, it will sync, otherwise it will not, whatever the value of the field in Marketo. No escape.


Finding #2: The sync stops immediately when the "sync with Marketo" is set to False in SFDC.

When the sync is disabled, it stops immediately. Really. There is not such thing as a "last sync". This means that the last "transaction" in SFDC is completely ignored from Marketo,with all the value changes in this transaction. Even the "Sync with Marketo = False" info will not visible to Marketo.


Example: Imagine that you have an SFDC workflow that disables the sync when the contact is set to "inactive". The workflow will fire IN THE SAME TRANSACTION as the "inactive contact" setting. Then the sync will be imediately disabled, thus preventing the next sync to happen. This means that Marketo will never know that the contact is not "Inactive" (or whatever field value change you may have done editing the contact). If you had expected to use this information in Marketo, for instance to remove the lead from the Marketo DB, you will not be able to . In another post, we will detail a workaround on how to handle that, but it will take some advanced SFDC skills.


Finding #3: you can cut sync from Marketo but you can only enable it from SFDC

This is a consequence from the previous findings and from the way the sync works.


Starting from a sync'ed lead or contact, if you uncheck the "Sync with Marketo" field in Marketo, you will be in a temporary situation where the field is still "true" in SFDC and the sync continues to work (See Finding #1). On next sync, which will work, the "False" value will be pushed to SFDC, and from there, the sync will be immediately disabled. So, you can easily disable the sync from Marketo.


But you cannot re-enable it from Marketo since, as the sync is now disabled, any change in Marketo will no longer be pushed to SFDC (See Finding #1). In SFDC, the field will remain to "False", unless you edit and change it there. And as stated in Finding #1, the only value that matters is the one from SFDC.


Consequence: if you need to reestablish a sync, it can only be done in SFDC.


Similarly, if you are creating new leads from Marketo, you should rather make sure they will be marked as "sync'ed" on creation in SFDC.


Finding #4: once the sync is disabled, the account info continues to sync

That one was not anticipated, although, after a second thought, since the account is a separate object in Marketo and SFDC, it makes sense. Let's say you have a contact and an account in SFDC that sync with Marketo. Then you deactivate the sync on the contact. The sync will stop for the contact. But not for the account. So if after this, you change some account values in SFDC, they will be visible on the lead in SFDC, even on the one that does not sync. It is a little surprising to see the industry or the billing address changing on a Marketo lead that is not supposed to sync...


The good news is that it is possible to also ask for accounts to have a sync filter.


Finding #5: if you stop a sync and reactivate it later, it will resync the right lead / contact

This is another apparently obvious one, but worth saying: if you unsync a lead contact, then change your mind before it has been deleted from Marketo, no problem, just reactivate the sync FROM SFDC, and it will automatically resync all field changes that have occurred in between.



One common question is how can we add a list of emails to the durable unsubscribed list, coming for instance from other systems, without increasing the size of the Marketo database. This is a key requirement as soon as you use other systems than Marketo to send emails and want to keep complying with legal requirements.


This getting even more complex if one has to manage the fact that some of these leads already exist in the Marketo database and should be kept there, together with their historical information.


The idea is to create a simple program that will handle this efficiently and automatically. Here are the components of the program :

  1. Let start with the "DurableUnsubscribed Import" list : This is where the durable unsubscribed will be imported. Once the process is finished as we will see, the list will be empty.
  2. The "Durable Unsubscribed Deletion List" will contain all the leads that are unsubscribed but should not be kept in the database. In other words, they were added to Marketo when you imported leads to the Durable Unsubscribe Import list. It's filters are set as is :
    • Please note the usage of the "lead was created" filter with a "List Name" constraint : it enables you to detect specifically the leads that were added only to be added to the DUL.
    • We combine this with a "member of list" filter that also checks during the process that the lead is still a member of the import list. As the lead deletion will occur after 2 hours, it enables you to change your mind and remove a lead from the list.
  3. The smart campaign that does the job is a triggered one
    • It will fire when the lead is added to the list
    • As it is not allowed to change the "unsubscribe" field through an import, we need to handle it in the smart campaign flow :

      Then we wait 2 hours to leave Marketo ample time to log the un-subscription (We can even leave it 1 day, but do not make it too short). After this delay, we check the lead is still there, waiting for deletion and has been created during the import. For this, we check the lead still belong the the "Durable Unsubscribed Deletion List" smart list and, if so, we delete it.Finally, if the lead has not been deleted (meaning it was there already and is supposed to have some history in the database), we remove it from the Import List


Alternatively, we can set the smart campaign as a batch and run it manually after completing an import in the Import List. In this case, we would replace the trigger with the  following filter :


This process will also work if you use the import list API calls and import them to the "Durable Unsubscribe Import" List :


Do not hesitate to provide feedback and alternatives, I'll incorporate them.



Filter Blog

By date: By tag: