Interesting. Marketo says I get 50K API calls per day, each call allowed to insert a max of 300 leads per call (Marketo's REST API documentation is my source for that; I haven't tested those limits so if Marketo is lying to me about it then the rest of the math here isn't applicable). My math says that means I can insert a hard upper limit of 15 million or so leads per day (if I can manage that with a limit of 5 calls per second). If we allow for an overhead of as many as 4 calls per insertion, that still equates to a little under 4 million leads per day. I doubt our end-user with a 14.4 modem can submit that many leads that would pass our validity checks in half an hour. But let's say he can, that's not the only tool in the box: If aside from checking the validity, we rate limit to one contact form submission from a particular user every 20 seconds or so, our single user (oh, give him a full-bandwidth pipe instead of a 14.4 modem) gets to use up about 50K leads per day, leaving plenty of room for the rest of the world.
Or were you assuming I was going to make my server pretend to be a browser submitting a form?
By having the lead form post to our server, and not Marketo, we can not only control for the validity of the leads going to Marketo, but we can control the size of the batches and how frequently we update Marketo. Side effect: If we generate a spectacular amount of interest, we can buffer the leads accumulated on our end and send them in as rate limitations allow. So if for some reason we generate more than a few million leads in a day (or a stretch of days) we could buffer them on our end, and get them in to Marketo when time, and rate limitations, permit. Admittedly, if that keeps up for a long stretch of time it can become worrisome. But if that's the case we'll be making enough in profits to cover more drastic, and expensive, approaches. Anyway, we're still looking at it as a possibility; we'll have to do some serious tire-kicking (read: code writing) before we head in that direction.
I haven't used the reCAPTCHA with Marketo for two main reasons. First, I don't use the Marketo forms designer because we have not been able to consistently (that's probably an understatement; I don't think she's passed even one of them) produce forms that pass our designer's standards using it. And second, I don't like arms races; I prefer not to play. Google has twice already revamped reCAPTCHA, so I suspect I'm not alone in mistrusting it as a long term solution (though I'll admit to being a little fascinated by their current 'invisible' approach, and wondering how it'll work out with mobile and assistive tech users and other fringe cases). Hence my focus on server-side controls.
Anyway, this has now gone way far afield from the original topic. My fault, my apologies. It was not my intention, but the right buttons were pressed, and I gave in.
.png)