Is there a small business certification I need, or is self-certifying in SAM.gov enough?

Corinne is right that for federal contracts, you self-certify your small business status directly in SAM.gov, but the SBA does not issue a general small business certificate. The emails you are receiving are likely referring to the separate certification processes for specific small business programs, such as the 8(a) Business Development Program, HUBZone, WOSB, or SDVOSB, which do require an application to the SBA. For example, for SDVOSB status, a concern must apply to SBA for certification and must be at least 51 percent owned and controlled by one or more veterans. These specific certifications allow access to set-aside contracts for those programs. State and local government procurement, as you noted, often have their own separate certification processes and requirements that are distinct from federal small business status.

Self-certifying in SAM.gov is it for plain small business set-asides. SBA doesn't issue a general small business certificate, so the emails offering to get you "certified" are selling you something that doesn't exist at the federal level.

The box you checked is your representation under FAR 52.219-1, and it's repeated in your annual reps and certs in SAM per FAR 4.1201. 13 CFR 121.404(a) says size is judged as of the date you submit your initial offer that includes price, against the size standard for the NAICS code the contracting officer put on that solicitation. So it's the solicitation's NAICS that counts, not just the one you listed as primary.

SBA checks your size when someone challenges it. Under 13 CFR 121.1001 another offeror, the contracting officer or SBA can file a size protest after award notice, and the SBA area office decides it. Nobody audits you up front. You also have to recertify after a merger or acquisition and on long-term contracts, 13 CFR 121.404(g) covers that.

The certifications SBA actually runs are 8(a), HUBZone, WOSB and EDWOSB, and the veteran certifications. Those need an application.

State "certified small business" programs are a separate thing. We had to apply through the state's own office before the state portal would show us as small on a janitorial bid, even though we'd been small in SAM for years. Check that state's procurement code or vendor guide for its own definition.