Adobe has three changes coming to Marketo Engage over the next six weeks.
Two take effect on August 31, with another coming on September 30.
On the surface, none of them looks particularly complicated. One involves an MX record, one changes how REST API calls carry their authentication token, and one introduces a new size limit for static lists used in activity API calls.
The technical fixes should be manageable if you know your setup.
The harder question is usually who owns each one.
We have been working through these changes with clients, and that is where we see the most friction. The fix itself can take an afternoon. Finding the right person, understanding what connects to Marketo, and figuring out how that connection works can take considerably longer.
Here is what is changing and what we recommend doing about it.
What is changing in Marketo?
1. Branded return-path MX records
The first change affects email.
Adobe is moving Marketo Engage to its Federated Email Service, a shared sending platform used across Adobe products.
Most Marketo subscriptions will not be affected. The exception is instances using a branded return-path, where a subdomain of your own domain is used as the envelope-from address instead of Adobe’s default mktomail.com.
Branded return-paths help keep your sending reputation associated with your brand and allow SPF alignment for DMARC. They work through an MX record that points back to Adobe’s email infrastructure.
That MX target is changing.
Adobe has published new values by pod, and the affected group of pods needs to be updated by August 31.
2. REST API authentication
The second change affects Marketo REST API integrations.
Historically, an access token could be passed as a query parameter at the end of the API URL. After August 31, that will no longer work.
The token will need to be passed in the Authorization header instead.
The good news is that nothing else about the authentication process is changing. Your client ID, client secret, and identity endpoint remain the same.
The challenge is identifying every integration that might still be using the old authentication method.
3. A new 10,000-member static list limit
The third change arrives on September 30.
Calls to Get Lead Activities or Get Lead Changes that reference a static list will start failing if that list contains 10,000 or more members.
Adobe’s guidance is to either keep the lists you are polling below that threshold or move to bulk extract and join the data back to list membership afterward.
Again, the fix itself is fairly straightforward.
The question is whether you know which integrations are making these calls in the first place.
The email change deserves the closest attention
The API and static list changes should fail visibly.
An API call stops working. A sync fails. A job generates an error. Someone notices and raises a ticket.
The MX change is different.
If the record is not updated, your email can keep sending. Delivery reporting can continue to populate. Opens and clicks can still come through. Your campaign dashboards can look completely normal.
What stops is asynchronous bounce processing.
Some receiving mail servers accept an email initially and reject it later. When that happens, they send a bounce notification back to the return-path address.
If the MX record is no longer pointing to the correct place, those notifications cannot be processed.
Adobe estimates that this typically affects less than one percent of messages sent. But the number of affected messages is not really the important part.
The important part is what those bounces are telling you.
A bounce is a signal that a specific address is no longer deliverable. If that information does not make it back into Marketo, the address can continue to be treated as valid and receive future sends.
That creates a few downstream problems.
Deliverability
Continuing to send to addresses that no longer exist can contribute to poor sending practices over time. The issue is not the individual bounce. It is what happens when invalid addresses remain in your database and continue receiving email.
Data quality
Bounce information does not necessarily stay within Marketo.
It can feed lead scoring, database health reporting, and CRM processes. If that information is missing, your teams may continue working with records that the platform would otherwise have identified as invalid.
Your database can look healthier than it really is.
Database costs
There is also a cost implication.
Marketo Engage is priced based on database size. When your database approaches its limit, one option is to clean out invalid or unnecessary records.
But you need reliable bounce data to know which records are actually invalid.
Without that information, you may end up keeping records you would otherwise have removed and paying to store them instead.
Once the MX record is corrected, Adobe can identify affected recipients and mark them as hard bounces.
What cannot be undone is what happened while the bounce information was unavailable. The emails were already sent, and your database and reporting were already operating with incomplete information.
Three changes. Three different owners.
This is where these relatively small changes can become a much bigger operational problem.
The MX record probably belongs to IT, networking, or whoever manages DNS.
The API authentication change belongs to whoever built or maintains the integration. That might be an internal developer, a contractor, or a vendor.
The static list change belongs to Marketing Operations.
Three changes. Three owners. And in many organizations, those people do not report to the same team.
That is why having an up-to-date integration inventory matters.
The technical work is often the easy part.
Discovery is the expensive part.
If you do not know what connects to Marketo, how those connections authenticate, where the credentials are managed, or who owns them, a small platform change can quickly become a much larger workstream.
What should take an afternoon can turn into weeks of investigation and coordination.
Don't turn it into a project. Make it a list.
You do not need a six-month documentation exercise.
Start with one simple inventory.
For each connection to Marketo, document:
- What connects to Marketo: a script, webhook, middleware job, iPaaS flow, vendor connector, or something else
- How it authenticates: including where credentials or tokens are managed
- Who owns it: the person responsible today and who should be contacted if they leave
That gives you a much clearer picture of your marketing technology environment and makes future platform changes significantly easier to manage.
A two-minute check you can do today
There is also one quick check worth doing now.
Send yourself an email from your Marketo instance and look at the message headers.
If the return-path is on mktomail.com, the August 31 email change does not apply to you.
If the return-path uses a subdomain of your own domain, you will need to determine which pod you are on and whether your MX record needs to be updated.
One important point: do not assume you are exempt because you use a shared IP rather than a dedicated IP.
Adobe documents branded return-path as available on both shared and trusted IP ranges, so IP type alone does not tell you whether the change applies.
For most instances, there will be nothing to change.
And that is fine.
The important thing is being able to establish that quickly.
Start with your integration inventory
These three Marketo changes are unlikely to be the last.
Adobe is continuing to consolidate Marketo Engage onto shared Adobe infrastructure and identity. The Federated Email Service is one visible part of that broader direction.
The best way to prepare for the next change is not another last-minute scramble.
It is knowing what you have today.
We have created an Integration Inventory Template with the questions we use to map Marketo integrations, authentication methods, ownership, and the connections that are easy to forget.
Get the Integration Inventory Template →
Because the question we would ask first is simple:
If the person who built your most important Marketo integration left tomorrow, how long would it take you to work out how it authenticates and what would break without it?
If you know the answer, you are in good shape.
If you do not, now is a good time to start documenting it.
