No, if the application is used solely by the customer, or any third party trust the application because they trust your customer. (not you)
For example: A administration panel, a web site that is under the customer's solely Control, a shopping page for customers etc.
Yes, if the application provides value to a third-party, and this third-party should not need to trust the customer.
For example if a user select to trust this SaaS application without implication of which customer it is.
Another example is a credit card entry form by a PCI DSS compliant aquirer. If the aquirer allows the customer to set his own domain on the CC form, then the customer's DNS server must be protected on the PCI DSS level, since if this are modified, the domain can be aimed on a CC collecting malicious site.
One example of this is that you provide antivirus scanning, and then you sell this "without brand name" to a customer, which can put his own name on the antivirus solution.
If the customer trust this solution because the Engine come from you, then your customer can turn malicious and aim the SaaS domain on a malicious site at any time.