diff --git a/cmd/configuration.go b/cmd/configuration.go
index fdd99de30..2480187bd 100644
--- a/cmd/configuration.go
+++ b/cmd/configuration.go
@@ -88,7 +88,9 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 	defaultMarathon.Endpoint = "http://127.0.0.1:8080"
 	defaultMarathon.ExposedByDefault = true
 	defaultMarathon.Constraints = types.Constraints{}
-	defaultMarathon.DialerTimeout = flaeg.Duration(60 * time.Second)
+	defaultMarathon.DialerTimeout = flaeg.Duration(5 * time.Second)
+	defaultMarathon.ResponseHeaderTimeout = flaeg.Duration(60 * time.Second)
+	defaultMarathon.TLSHandshakeTimeout = flaeg.Duration(5 * time.Second)
 	defaultMarathon.KeepAlive = flaeg.Duration(10 * time.Second)
 
 	// default Consul
diff --git a/docs/configuration/backends/marathon.md b/docs/configuration/backends/marathon.md
index 2c57c1c43..98ce7ed3b 100644
--- a/docs/configuration/backends/marathon.md
+++ b/docs/configuration/backends/marathon.md
@@ -120,9 +120,33 @@ domain = "marathon.localhost"
 # If no units are provided, the value is parsed assuming seconds.
 #
 # Optional
+# Default: "5s"
+#
+# dialerTimeout = "5s"
+
+# Override ResponseHeaderTimeout.
+# Amount of time to allow the Marathon provider to wait until the first response
+# header from the Marathon master is received.
+# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
+# values (digits).
+# If no units are provided, the value is parsed assuming seconds.
+#
+# Optional
 # Default: "60s"
 #
-# dialerTimeout = "60s"
+# responseHeaderTimeout = "60s"
+
+# Override TLSHandshakeTimeout.
+# Amount of time to allow the Marathon provider to wait until the TLS
+# handshake completes.
+# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
+# values (digits).
+# If no units are provided, the value is parsed assuming seconds.
+#
+# Optional
+# Default: "5s"
+#
+# TLSHandshakeTimeout = "5s"
 
 # Set the TCP Keep Alive interval for the Marathon HTTP Client.
 # Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
diff --git a/provider/marathon/marathon.go b/provider/marathon/marathon.go
index bdf13510a..193e67777 100644
--- a/provider/marathon/marathon.go
+++ b/provider/marathon/marathon.go
@@ -55,8 +55,10 @@ type Provider struct {
 	MarathonLBCompatibility   bool             `description:"Add compatibility with marathon-lb labels" export:"true"`
 	FilterMarathonConstraints bool             `description:"Enable use of Marathon constraints in constraint filtering" export:"true"`
 	TLS                       *types.ClientTLS `description:"Enable TLS support" export:"true"`
-	DialerTimeout             flaeg.Duration   `description:"Set a non-default connection timeout for Marathon" export:"true"`
-	KeepAlive                 flaeg.Duration   `description:"Set a non-default TCP Keep Alive time in seconds" export:"true"`
+	DialerTimeout             flaeg.Duration   `description:"Set a dialer timeout for Marathon" export:"true"`
+	ResponseHeaderTimeout     flaeg.Duration   `description:"Set a response header timeout for Marathon" export:"true"`
+	TLSHandshakeTimeout       flaeg.Duration   `description:"Set a TLS handhsake timeout for Marathon" export:"true"`
+	KeepAlive                 flaeg.Duration   `description:"Set a TCP Keep Alive time in seconds" export:"true"`
 	ForceTaskHostname         bool             `description:"Force to use the task's hostname." export:"true"`
 	Basic                     *Basic           `description:"Enable basic authentication" export:"true"`
 	RespectReadinessChecks    bool             `description:"Filter out tasks with non-successful readiness checks during deployments" export:"true"`
@@ -105,7 +107,9 @@ func (p *Provider) Provide(configurationChan chan<- types.ConfigMessage, pool *s
 					KeepAlive: time.Duration(p.KeepAlive),
 					Timeout:   time.Duration(p.DialerTimeout),
 				}).DialContext,
-				TLSClientConfig: TLSConfig,
+				ResponseHeaderTimeout: time.Duration(p.ResponseHeaderTimeout),
+				TLSHandshakeTimeout:   time.Duration(p.TLSHandshakeTimeout),
+				TLSClientConfig:       TLSConfig,
 			},
 		}
 		client, err := marathon.NewClient(config)