Best Practice: Hosting external facing resources in Marketo?

As an overall goal you should be able to trust your assets to reside on Marketo's servers as much as you trust Marketo to be up and running in general.  There's no reason to arbitrarily create another point of failure by hosting assets elsewhere.

However, there's no single best practice because if your already users are using a CMS/DAM to manage assets -- some of those are even involved in InDesign/Photoshop or other workflow -- it's an unnecessary hardship and loss of functionality to make that stuff get copied to Marketo.

So the real question is what exactly is your "elsewhere"?

Was looking into hosting the assets on our own web servers managed by our web dev team...
assuming if done this way we can better gate and capture data on prospects that were forwarded link.

It is fine to host assets on your own server. As long as muchkin exists and you use the regular link tracking in marketo, you can see behaviors.
 

As Sanford suggests, hosting these on marketo is also fine.

I do recommend hosting all email images in Marketo and any images for Marketo LPs as well.

@Bryant C A link typically goes via the Marketo click tracking server (your branding domain) in order to be linked to the lead's activity history.  If a lead forwards a link it still carries their identifying info, so later clicks will also be linked to the original lead.  This is why the "Forward to a friend" functionality exists (though in my experience it is almost never used).  You don't change this underlying situation by locating assets on your server.

Are you planning on tracking all of your link clicks using your own custom code, and tying back to leads using the Marketo REST/SOAP API?  That's a tall order for your developers and a lot of effort to deal with the relatively minor problem of forwarding (I'm not saying it's a totally negligible problem, but you may find your developers questioning the relative importance when they see that they're reinventing the wheel).

If we host on our own servers, couldn't we gate the asset from everyone besides cookied contacts? requiring net new to fill out form?

And your right, I do not want to make more work for my developers.
But think I will run into other reporting difficulities if hosting on marketo because there isn't a design studio/asset report.
And we are hosting marketo forms on non-marketo landing pages... making it difficult to report on that too.

 
 

You don't need to report on direct asset downloads because you should never offer direct non-logged links (even a seemingly direct link in an email isn't really direct, since it's rewritten by Marketo to bounce off the click tracking domain and then redirect to the asset itself).

Make sure assets are downloaded via a server with Munchkin loaded and you'll get the original email click + all subsequent web activities for known leads -- and clicks to download assets + all other web activities for anonymous leads. And remember, those anonymous leads can be turened into known leads and Marketo will merge all the old web history with the new/learned lead.

There are good reasons to host assets on your own server -- existing workflow steps or simply existing file storage, for example -- but user-facing analytics isn't really one of them. (Having deeper web server logs of the requests might be useful to a sysadmin in a troubleshooting situation, but I don't consider that a topline reason.)  We happen to host on our server but that's because people already use the CMS to manage asset versions. We don't expect the marketing folks to look at web server logs, as anything that isn't visible in Marketo is a sign we're doing something wrong.