dht/dht.go | 12 ++++++++++++

diff --git a/dht/dht.go b/dht/dht.go
index 78875578080fa5538ff8776eb38333b53cd9f765..de96fe9ecb4e1e7e3c218752511e608b9e42423a 100644
--- a/dht/dht.go
+++ b/dht/dht.go
@@ -1052,12 +1052,24 @@ 	}
 	return
 }
 
+// Adds bootstrap nodes directly to table, if there's room. Node ID security
+// is bypassed, but the IP blocklist is not.
 func (s *Server) addRootNodes() error {
 	addrs, err := bootstrapAddrs(s.bootstrapNodes)
 	if err != nil {
 		return err
 	}
 	for _, addr := range addrs {
+		if len(s.nodes) >= maxNodes {
+			break
+		}
+		if s.nodes[addr.String()] != nil {
+			continue
+		}
+		if s.ipBlocked(addr.IP) {
+			log.Printf("dht root node is in the blocklist: %s", addr.IP)
+			continue
+		}
 		s.nodes[addr.String()] = &node{
 			addr: newDHTAddr(addr),
 		}