If there is a DTO for each entity, then which application layer is responsible for validation?

Question

Software design

Let's say there is an entity User, it has 2 fields, email and password. It's 2 ValueObjects. VOs must always be valid, before we create them we use DTOs. And the question arose, Which of the 2 levels, DTO or VO, are responsible for validation?

$dto = new UserDTO($data) // тут валидируем
$user = new User($dto);

....
 
public function __construct(UserDTO $dto)
{
   $this->email = new UserVOEmail($dto->email); //  или тут валидируем
...
}

Answer 1

Value object is not just a class structure but has the logic of work within its entity, validation is suitable.
DTO - purely structure for data transport