Good points are made above. The services layer is also the place to put your transaction and security interceptors, not against the DAO.
Also, in our applications our DAO hierarchy extends from a base which provides CRUD operations for a generic PersistableEntity, whilst our services layer works with specific domain objects:
Code:
public interface Dao {
public long create(PersistableEntity object);
}
public interface BillingManager {
public long create(Bill bill);
}
Thus a services layer also handles casting to/from the generic DAO as well. I find it surprising how often people write a fresh DAO for everything, when using a generic base like this will save them a lot of duplication.