Start here. This is the direct spoken answer to practice first.
Why this question matters
Business logic should live near the state and concepts whose correctness it protects. That does not mean an entity should send email, open transactions, or call remote services.
I put local invariants and valid state transitions on entities or value objects, such as preventing a shipped order from being cancelled or ensuring money has a currency. Rules that combine several domain concepts but do not naturally belong to one entity can live in a domain policy. The application service coordinates loading data, invoking the decision, saving changes, and arranging external effects.