"cname.dnsp.co" returns a CNAME whose target carries the message, as a companion to the "mismatch" test.
Where a type-mismatched answer is usually discarded, a CNAME is not: following an alias is ordinary DNS behaviour and every resolver does it, for any query type. That makes a name itself a reliable way to carry information back to you through parts of the network that would filter anything else.
Comparing this with "mismatch.dnsp.co" is the point. If the CNAME arrives but the mismatched TXT does not, you have learned that your resolver filters by type but follows aliases — which is the normal and correct combination.
prompt> dig cname.dnsp.co A @dnsp.co ;; ANSWER SECTION: cname.dnsp.co. 0 IN CNAME this-text-rides-in-a-name.dnsp.co.