In 2021, Marketo Engage will be making changes to the URL structure for Landing Pages, Forms, and Images & Files assets.   Why is this change being made? Technical Details Landing Pages Images & Files Forms What customer action is required?   When is this change being made? Starting January 21, 2021, we will begin gradually provisioning new Marketo Engage subscriptions with the new URL structure. On March 5, 2021, all new Marketo Engage subscriptions will be provisioned with the new URL structure in place.   For existing Marketo Engage subscriptions, we will begin gradually rolling this change out beginning April 1, 2021. More details on our rollout timeline will be released in March, 2021.   Why is this change being made? When a Marketo Engage subscription is not configured with a branded CNAME, Design Studio assets use a common hostname shared among all customers on the same pod. This behavior can be exploited in a phishing attack where a user cannot be sure a link to a Marketo Engage hosted asset belongs to the business they expect it to belong to. By updating each instance to use its own unique hostname, it is clearer to users the destination of URLs they are accessing.   Technical Details Landing Pages, Form embed code, and resources stored in Images & Files will have URLs updated from a hostname shared among all subscriptions on the pod to a hostname unique to each Marketo Engage subscription. Subscriptions configured to use a custom CNAME for their landing pages will be minimally affected by this change.   Landing Pages Subscriptions without a configured landing page domain Landing page paths will change to a unique hostname for your subscription. Before: http://na-sj01.marketo.com/lp/123-ABC-456/unsubscribePage.html After: http://123-ABC-456.mktoweb.com/lp/123-ABC-456/unsubscribePage.html   Subscriptions with a configured landing page domain Landing pages will continue to load from your configured landing page domain. No changes will be made. Before: http://example.marketo.com/unsubscribePage.html After: http://example.marketo.com/unsubscrigePage.html   Images & Files Subscriptions without a configured landing page domain Paths to resources stored in Images & Files will change to a unique hostname for your subscription. Before: http://na-sj01.marketo.com/rs/123-ABC-456/images/cuteKitten.png After: http://123-ABC-456.mktoweb.com/rs/123-ABC-456/images/cuteKitten.png   Subscriptions with a configured landing page domain Resources stored in Images & Files will continue to load from your configured landing page domain. No changes will be made. Before: http://example.marketo.com/rs/123-ABC-456/images/cuteKitten.png After: http://example.marketo.com/rs/123-ABC-456/images/cuteKitten.png   Forms Subscriptions without a configured landing page domain OR subscriptions without landing pages secured by SSL Before:   <script src="//app-sj01.marketo.com/js/forms2/js/forms2.min.js"></script> <form id="mktoForm_1"></form> <script>MktoForms2.loadForm("//app-sj01.marketo.com", "123-ABC-456", 1);</script>   After:   <script src="//123-ABC-456.mktoweb.com/js/forms2/js/forms2.min.js"></script> <form id="mktoForm_1"></form> <script>MktoForms2.loadForm("//123-ABC-456.mktoweb.com", "123-ABC-456", 1);</script>     Subscriptions with a configured landing page domain secured by SSL In our October 2020 release, we updated our form embed code to load from the landing page domain when it is secured by SSL. No further changes will be made. Before:   <script src="//example.marketo.com/js/forms2/js/forms2.min.js"></script> <form id="mktoForm_1"></form> <script>MktoForms2.loadForm("//example.marketo.com", "123-ABC-456", 1);</script>   After:   <script src="//example.marketo.com/js/forms2/js/forms2.min.js"></script> <form id="mktoForm_1"></form> <script>MktoForms2.loadForm("//example.marketo.com", "123-ABC-456", 1);</script>     What customer action is required? Marketo Engage subscriptions provisioned after March 5, 2021 will have the new URL structure already in place for all Design Studio assets. Existing Marketo Engage subscriptions will be migrated in a staggered rollout to the new URL structure during nightly maintenance cycles. There will be no downtime, but landing pages may experience a short period of degraded performance during migration. Existing URLs and references will continue to work after the migration to the new URL structure. However, in 2022, we will deprecate the old URLs structure in use today. More details on our deprecation timeline will be provided in March 2021.   To begin preparing for this change, we suggest doing the following: Configure your Landing Page URLs with a CNAME https://docs.marketo.com/display/public/DOCS/Customize+Your+Landing+Page+URLs+with+a+CNAME Secure your Landing Pages with SSL https://docs.marketo.com/display/public/DOCS/Add+SSL+to+Your+Landing+Pages Begin updating pages where you embed Marketo Engage forms with the new embed code introduced in our October 2020 release (requires secured landing pages) Begin an audit of where you reference Design Studio assets on the web. This will help you begin a plan to update any existing references to our older URL structure before we begin deprecation in 2022. ... View more

What’s changing? In our May 7, 2021 release, Marketo Engage will be making changes to our form platform to protect the stability and security of our infrastructure:   Forms 1.0 will be fully deprecated, resulting in loss of functionality of any remaining Forms 1.0 assets still in use. Marketo Engage will begin rejecting form submissions made through unsupported methods, such as programmatic form POSTs to the leadCapture/save and leadCapture/save2 endpoints.   Why is this change being made? On August 1, 2017, Marketo Engage deprecated the Forms 1.0 editor, removing the ability to create or edit Forms 1.0 assets. This change will complete our end of life efforts for Forms 1.0.   In addition, we have found that our Form endpoints “leadCapture/save” and “leadCapture/save2” are common targets for bot attacks. To protect the stability of the Marketo Engage infrastructure, and to aid customers in maintaining a clean database, we are completely disabling the “leadCapture/save” endpoint and enforcing checksum validation on the “leadCapture/save2” endpoint.   What customer action is required? Forms 1.0 deprecation Provisioning of Marketo Engage subscriptions with the ability to create Forms 1.0 assets ended December 31, 2014. If your subscription was provisioned after this date, then it will not have Form 1.0 assets. Forms 2.0 assets will be unaffected by this change.   Marketo Engage subscriptions provisioned before December 31, 2014 may still  be utilizing Forms 1.0 assets on their landing pages and website. These forms will need to be remade in our Forms 2.0 editor and replaced wherever they are still being used.   Programmatic Form POST deprecation Some integrations may be performing programmatic form POSTs to “leadCapture/save" or “leadCapture/save2” to submit data into Marketo Engage databases. This method of data ingestion has always been unsupported and will cease to work as part of this deprecation. All integrations using programmatic form POSTs must be updated to use our Forms 2.0 API, Push Lead REST API, or the Submit Form REST API endpoint releasing in the January 2021 release.   Customers using native Forms 2.0 assets on pages and/or the Forms 2.0 API do not need to take any action. Checksum validation will work natively with these supported methods.   What happens if customers don’t act? Customers that fail to replace any in-use Forms 1.0 asset with a Form 2.0 asset will find that their customers will be unable to submit to their 1.0 Forms.   Customers using integrations that perform programmatic Form POSTs to the “leadCapture/save” or “leadCapture/save2” endpoints will see these integrations fail, resulting in loss of form submission data.   Is my Form 1.0 or 2.0? Forms 1.0 and Forms 2.0 have different look and feel:   Forms 1.0 Forms 2.0 Marketo subscriptions provisioned after December 31, 2014 will only have Forms 2.0 assets. ... View more

OVERVIEW Marketo Engage customers and partners have use cases or preferences for using non-Marketo forms, but still want submissions to enter their Marketo database. Many integrations today do so using server-side form POSTs to our /save or /save2 endpoints, which is an unsupported and forbidden method of data entry to our platform. To meet these needs, we have developed a REST API endpoint meant to mimic the submission of a Marketo form including lead association and creating a “Fills Out Form” activity.   BETA DETAILS This beta will allow access to the Submit Form REST API endpoint. This endpoint replicates the behavior of Marketo forms: Creates and updates Person records in your database Creates “Filled Out Form” activities on Person records which react to qualifying Triggers and Smart List filters Performs anonymous person association when calls are submitted with cookie values   During the beta program you must: Report on defects found during beta testing within one (1) business day. Answer survey questions as needed. Provide feedback regarding product documentation and help systems. Be willing to act as a media reference for the product.   In return, you will get: Involvement in the development cycle, which includes the ability to influence the final code and submit enhancement requests prior to release. More stable code due to multiple individuals testing in many environments. One-on-one contact with Product Management. Resulting knowledge gained from participating in the beta test program. Joining the beta If you are interested in participating in this beta, please do the following:   Sign the Adobe DX Closed Beta Agreement and specify me as your Adobe contact, svanderb@adobe.com https://adobedealreg.secure.force.com/click2accept?type=7 Fill out the Submit Form beta request form with your contact and subscription information https://forms.office.com/Pages/ResponsePage.aspx?id=Wht7-jR7h0OUrtLBeN7O4epuYNI0IWZLgH1mr3nTaPdURVYySDg5RUJJWjlKTEZZMFU0RzhUQks2Si4u We will provide you with access and documentation to the API endpoint after reviewing your application.   Enrollment will be open from October 1st - October 31st. We aim to release this endpoint GA in our January release. Feedback Email Us  Be open to calls to discuss bugs or enhancement requests Share your use cases with the Product Team   Steven Vanderberg | Product Manager, Marketo Engage Product Management | Adobe ... View more

  Note: This document applies to the Marketo Secured Domains for Tracking Links product only.   Every link you include in your Marketo emails will have tracking code automatically appended when sent. For those in highly regulated industries, your company may require that you securely encrypt the Marketo tracking links. Remember that Marketo takes the URLs you place inside of emails and shortens them using the "Branded Tracking Link" domain (this is another CNAME you set up in Marketo under Admin--> Email). These tracking links are how Marketo enables you to track engagement with your emails.   Setting Up Secured Domains for Tracking Links instructions - Setting Up Secured Domains for Tracking Links   Do I need to secure my Tracking Links? If your company (likely IT) has implemented HSTS, you WILL need to secure your tracking links for your recipients' email->web page redirect to function correctly. Additional information on HSTS, including how to check if it's been implemented on your domain can be found here: SSL: The HSTS Policy and Your Marketo Subdomains.   HSTS is a web server directive companies may choose to enforce which forces all subsequent requests for resources on that domain to be loaded through HTTPS.  This is most common for those in highly regulated industries, such as financial and healthcare institutions. Please note, enforcing HSTS does not also convert Marketo tracking links in emails to HTTPS - that must be done via Marketo Support.   Other Helpful FAQs What is Marketo Secured Domains for Tracking Links? This secures the tracking link domains (which is what makes the URLs appear as HTTPS instead of HTTP) by providing the SSL certificate for each unique domain. Please note tracking links are NOT the same as your SPF/DKIM domain, which is the domain from which your emails are sent., whereas this is the domain located within your emails that tracks click-throughs.   How many domains can I secure with the Secured Domains for Tracking Links? Technically, there is no limit to the number of tracking link domains a customer may have. The base Secured Domains offering included on all subscriptions covers the cost to secure your first tracking link domain; however, if you need more, you may simply add additional domains to your contract a la carte, so you only pay for what you need (in contrast to the previous bundled offering). Contact your Marketo Customer Success Manager for more information.   How is the Secured Domains for Tracking Links product different than the Secured Page Services, SSL for Tracking Links service? Unlike the legacy SSL-only service, Secured Domains not only generates and auto-renews all certificates needed for securing your domains, but provides an exponential layer to what 'secured' entails - it's not just an SSL certificate anymore. For a full explanation of Marketo's Secured Domains offering, and how it differs from just the SSL certificate, please see this Nation Post or check out this Marketo Blog Post about cyber-security and marketing.   What setup/configuration is required before securing my Marketo Tracking Links? You must configure (brand) your CNAMES for Email Tracking links. More information here: Brand Your Tracking Links   Can I secure my tracking links without securing my Marketo landing pages? Technically? Sure. But while secured tracking links have yet to be enforced by email clients, secured landing pages have been enforced by browsers since 2018, which is why we include both in our base bundle. The general public is far more likely to not stick around or enter personal data on an unsecured landing page than they are to not click an unsecured tracking link.   Do I need to provide a TLS/SSL Certificate? No. Secured Domains moves 100% of the SSL ownership to Marketo - all aspects of procuring, managing and renewing certificates is done automatically without human interaction. In fact, we only allow customer-provided certificates on an exception-only basis, OR if you require an Extended Validation (EV) type certificate.   What Certificate Authority issues the certificate(s) for the Marketo’s Secured Domains for Landing Pages product? The certificates are authored by DigiCert.   What type of certificate is provided? We produce a pack of two certificates; The primary certificate uses a P-256 key, is SHA-2/ECDSA signed, and will be presented to browsers that support elliptic curve cryptography (ECC). The secondary or fallback certificate uses an RSA 2048-bit key, is SHA-2/RSA signed, and will be presented to browsers that do not support ECC.   Will my domains be on a shared SSL certificate with other companies? As part of our Secured Domains products, each of your fully qualified domain names will get its own certificate. That means you will not be on a shared certificate with other companies.   Can I provide my own SSL certificate(s) to secure my domains? Not unless it's an Extended Validation (EV) type certificate. Marketo can only automatically renew the certificates we generate to secure your domains.   ... View more

For those in highly regulated industries, your company may additionally require that you securely encrypt the Marketo tracking links embedded in Marketo emails. Remember that Marketo takes the URLs you place inside of emails and shortens them using the "Branded Tracking Link" domain (this is another CNAME you set up in Marketo under Admin--> Email). These tracking links are how Marketo enables you to track engagement with your emails. Overview & FAQ - Overview & FAQ: Secured Domains for Tracking Links What's Changing Marketo has discontinued the Secured Page Services: SSL for Tracking Links service and its manual certificate renewal process. This is being replaced with the Marketo Secured Domains for Tracking Links product which provides all needed certificates and manages renewals automatically. Action Required To secure your email tracking links, contact your Marketo Customer Success Manager to add the Secured Domains for Tracking Links product to your subscription. Once you’ve purchased Secured Domains for Tracking Links for your instance: An automated message will be sent to the Support Admin on your account They will need to respond to the message with the Munchkin ID of the instance needing Tracking Links set up. Responding to this case will auto generate a Support Case for a Marketo technical support engineer to help complete the process. Marketo will then have certificates generated to cover all the domains and subdomains that you’ve set up in your instance. Within 3-business days, we will create a secure server endpoint. Please plan accordingly for this 72-hour turn-around-time. Do I need Secured Domains for Tracking Links? Secured Domains for Tracking Links ensure that tracking links can be served securely for domains which have implemented HSTS (HTTP Strict Transport Security). HSTS is a web server directive which forces all subsequent requests for resources on that domain to be loaded through HTTPS. If you have implemented HSTS at your site on any domain that you are choosing for either your Landing Page CNAME or your branded email tracking links domain, you will need Secured Domains for Tracking Links and/or Secured Domains for Landing Pages. How is the new Secured Domains for Tracking Links Better? With Marketo’s new Secured Domains for Tracking Links product, you no longer have to provide renewal/updated certificates to Marketo. We’ll procure any necessary certificates and manage their renewals automatically – giving you a more secure and convenient solution for securing your links in emails! Do I have to upgrade? An upgrade is required. Marketo no longer supports the legacy Secured Page Services: SSL for Tracking Links certificate renewal process. Will my tracking links automatically convert to HTTPS? You will not see tracking links in your Marketo emails changed to HTTPS (they will remain prefixed HTTP). However, when an end user clicks the link, if HSTS is enabled for the domain in the link being clicked and the browser is aware, the request will be automatically changed to HTTPS by the browser and served securely via HTTPS before re-directing to the destination of the link.   This means that no insecure connection occurs because the browser recognizes the HSTS security policy.  HSTS preload is required for this to work.   If a tracking link top level domain is not on the HSTS preload list, then link clicks will be insecure until the browser becomes aware of the HSTS policy on the target domain by visiting the site. Will my old links in emails continue to work? Links in emails will continue to function normally. Is this article helpful ? YesNo ... View more

Forms serve as a valuable point of entry to your Marketo Engage database for your prospective and existing customers to express interest in your business. They also serve as a portal for malicious actors to flood your database with junk data, hoping to trigger emails to use in phishing attacks, to overwhelm your business services, or to DDoS our platform. We are rolling out enhancements to strengthen the security of Marketo Engage forms to address this growing problem in the industry.   These features are releasing throughout Q3 2020 and will be available to all Secured Domains for Landing Pages customers. No changes to your forms or landing pages are needed to take advantage of these enhancements.   EDIT: We have delayed the rollout of our form field validation to Q1 2021 to ensure a high level of quality.   Bot Spam Blocking We have identified bot patterns common among most spam attacks on Marketo Engage forms. These patterns were identified by examining form data captured in bot attacks for values that were impossible to have been submitted by a human submitter. This new feature will introduce server-side validation on standard Marketo Engage form fields that will reject submissions of illegitimate values that match these bot patterns.   Sever-side form field validation Today, Marketo Engage forms enforce field data rules with client-side Javascript validation that is easily circumvented by bots or users that disable scripting in their browsers. To address this, we are enhancing forms with server-side validation of form field rules. These include: • Validation of field type. For example, checkbox form fields must be submitted with boolean values; numerical form fields cannot contain alphabetical characters, etc. • Presence of required fields • Values in Select type fields must match the configured list of values • Configured max length of field value is not exceeded • Numerical values fall within the configured minimum and maximum values Submissions to Marketo Engage forms that fail validation will return an error with the offending field highlighted with an error message.    Frequently Asked Questions:   Can my business define its own custom logic for rejecting form submissions based on submitted field values? Unfortunately, not at this time.   Should my business continue to use CAPTCHA, honeypots, or Javascript validation on our forms? We anticipate these enhancements will reduce the need for solutions such as CAPTCHA or honeypots, but they can still serve as an additional layer of security against bots for your forms. Custom Javascript validation will continue to give your business granular control over form field validation on your landing pages and web pages.   Will you block specific IP addresses we commonly see associated with spam? IP addresses on the internet are often dynamic and are recycled by ISPs to be used by multiple devices. Blocking an IP address could result in legitimate visitors unable to fill out your forms. It is also trivial for an attacker to switch to a different IP address or use a distributed network of IP addresses to spam your forms, which makes IP address blocking an ineffective long-term strategy. ... View more